Oracle Product Hub CVE-2026-101852

Exploitation requires network access over HTTP to the Oracle Product Hub component (Internal Operations) of Oracle E-Business Suite, plus a low-privileged authenticated account (CVSS PR:L) - it is NOT unauthenticated. Affected deployments are EBS versions 12.2.3 through 12.2.15 running the Product Hub module. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any valid low-privilege session is sufficient. Limiting factors that reduce real-world risk: the attacker must first obtain valid EBS credentials, the Product Hub HTTP endpoint must be reachable from the attacker's position, and only the listed 12.2.x versions are in scope; environments that restrict EBS web access to trusted networks and apply the October 2026 CPU are not exposed.

This is a credible mid-to-high priority issue, though not a drop-everything emergency. The confirmed CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity and availability impact culminating in 'takeover of Oracle Product Hub' per Oracle's description. That combination makes it attractive to any authenticated user (including low-privileged or compromised accounts) and to attackers who have already gained a foothold. Countervailing signals temper the urgency: this CVE is NOT listed in CISA KEV, no public proof-of-concept is referenced, and no EPSS score, SSVC decision, or CWE was supplied in the input - so there is no evidence of active or automatable exploitation at this time. The single authoritative reference is Oracle's October 2026 Critical Patch Update, which is a vendor-confirmed patch source but provides no independent exploitation telemetry. Net: treat as a priority patch for any internet- or intranet-exposed EBS Product Hub instance because the pre-conditions are low (any low-privileged HTTP-authenticated attacker), but absence of KEV/POC/EPSS signals suggests exploitation is not yet widespread. Note one inconsistency: the input 'Information Disclosure' tag understates the impact - the CVSS vector and description indicate full C/I/A compromise (takeover), not mere disclosure.

A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has phished/compromised such an account) sends crafted HTTP requests to the Internet- or intranet-facing Product Hub (Internal Operations) component. Because attack complexity is low and no user interaction is needed, the requests exploit the flaw to escalate to full control of the Product Hub application, compromising the master product data it manages. No public exploit code is currently referenced, so exploitation would require independent development against versions 12.2.3-12.2.15.