CVE-2026-87152

CVE-2026-87152 is an authorization flaw in the Create Item Instance component of Oracle Installed Base, a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15. A remote attacker who already holds a low-privileged (valid minimally privileged) account can exploit it easily over HTTP without user interaction, and gain unauthorized ability to create, delete, or modify critical Installed Base data as well as read that data in full. Installed Base tracks serialized item instances (installed assets, service and repair history), so successful attacks could expose sensitive customer asset data and corrupt service records. Organizations running affected EBS 12.2.x releases with the Installed Base module exposed to network users are affected. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87152 to all E-Business Suite 12.2.3-12.2.15 environments running Installed Base. Restrict HTTP access to EBS so only authenticated, trusted networks or VPN users can reach it, and audit low-privilege accounts for excessive grants. Review Installed Base item-instance change history and audit logs for unauthorized creation, modification, or deletion of records by low-privileged users.