Oracle Product Hub CVE-2026-101855

Exploitation requires a valid low-privilege Oracle E-Business Suite / Product Hub account reachable over HTTP, targeting the Internal Operations component on affected versions 12.2.3 through 12.2.15; per CVSS PR:L the attacker must be authenticated. Limiting factors: authentication is mandatory (not exploitable by fully anonymous attackers), impact is confined to confidentiality (no data modification or denial of service), and only the 12.2.x release line is in scope. The absence of required user interaction (UI:N) and low attack complexity (AC:L) mean that any attacker already possessing low-privilege credentials faces few additional barriers.

This is a moderate-priority vulnerability (CVSS 3.1 base 6.5) rather than a critical emergency, and the available signals are largely consistent. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates remote, low-complexity exploitation over HTTP, but it explicitly requires PR:L - the attacker must already hold valid low-privilege credentials, which meaningfully narrows the exploit population versus a true unauthenticated flaw. Impact is confidentiality-only (C:H, I:N, A:N): disclosure of sensitive data with no integrity or availability effect. There is no EPSS score provided, no CISA KEV listing, and no public POC referenced, so there is no evidence of active exploitation or weaponization - this is 'no public exploit identified at time of analysis.' A notable conflict: the input carries an 'Authentication Bypass' tag, yet the CVSS vector requires authenticated access (PR:L), so the tag appears inconsistent with the actual attack prerequisites and should not be relied upon. Net assessment: a credentialed-access data-disclosure bug in an enterprise ERP module - worth patching in the normal Oracle CPU cycle and prioritized where low-privilege EBS accounts are broadly provisioned, but not a drop-everything issue absent any exploitation signal.

An attacker with a valid low-privilege Oracle E-Business Suite account (or who has phished/compromised such credentials) sends crafted HTTP requests to the Internal Operations component of Oracle Product Hub to read data they are not authorized to see, potentially exposing all Product Hub-accessible data. Attack complexity is low (AC:L) and no user interaction is needed, but authentication is required and no public exploit code is currently known, so realistic abuse depends on prior credential access.