Oracle Product Hub CVE-2025-53043

Requires an authenticated low-privilege account on Oracle E-Business Suite (PR:L) with network HTTP access to the Product Hub Item Catalog component; affected deployments are EBS versions 12.2.3 through 12.2.14 running the Product Hub module. No user interaction and no elevated privileges are needed, and attack complexity is low, so any authenticated user who can reach the Item Catalog interface is in scope. LIMITING FACTORS: exploitation is gated by the need for valid EBS credentials (not remote-unauthenticated), by the Product Hub module actually being provisioned/in use, and by network reachability of the EBS HTTP interface - environments that restrict EBS to internal networks or do not deploy Product Hub are not exposed.

This is a genuinely serious but not emergency-tier issue. The signals are mostly consistent: the Oracle-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1) describes a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact (no availability impact). That maps to an authenticated (PR:L) attacker who can read and alter all Product Hub-accessible data. The real-world exploitation signals, however, pull the priority down: EPSS is only 0.38% (30th percentile), there is NO CISA KEV listing, and no public exploit code was identified - so there is no public exploit identified at time of analysis. The practical gating factor is PR:L: an attacker needs a valid, albeit low-privileged, Oracle E-Business Suite account, which limits opportunistic mass exploitation to insiders or attackers who have already obtained EBS credentials. CONFLICT TO NOTE: the input Tags include 'Authentication Bypass', which directly contradicts the CVSS vector's PR:L (authentication IS required) - treat the 'Authentication Bypass' label as unreliable, not a confirmed property. Also note the CWE is CWE-200 (Information Disclosure) yet the description and the I:H metric clearly indicate write/modify/delete impact, so this is broader than pure info disclosure. Net: a real patching priority for EBS Product Hub operators given high C/I impact and network vector, but the low EPSS, absent KEV, and credential requirement make it a 'patch in normal cycle' rather than 'drop everything' issue.

An attacker with a low-privilege Oracle E-Business Suite account sends crafted HTTP requests to the Product Hub Item Catalog component to read, create, modify, or delete critical Product Hub data outside their authorization. Because no user interaction is needed and complexity is low (AC:L), a single authenticated session suffices. No public exploit is currently known, so this would require original exploit development or insider access.