Oracle Product Hub CVE-2026-61275

The attacker must possess a valid, authenticated low-privileged account within the target Oracle E-Business Suite instance (PR:L per CVSS vector) - unauthenticated external attackers cannot exploit this directly. Network-level HTTP access to the EBS application tier is required (AV:N). No user interaction from a victim is needed (UI:N), and no specific non-default configuration is stated as a prerequisite in available data, meaning all Oracle Product Hub deployments running versions 12.2.3 through 12.2.15 with any authenticated user present are potentially in scope. Exploitation is bounded by the requirement to first obtain valid EBS credentials, which limits exposure to insiders, phishing victims whose credentials are compromised, or environments with weak EBS account provisioning controls.

The CVSS 3.1 score of 6.3 (Medium) accurately reflects the threat profile: network-accessible, low complexity, but gated behind authenticated (low-privileged) access with no scope change and only partial C/I/A impacts. This is not an unauthenticated or critical-severity flaw. EPSS data was not included in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists, and no public exploit or proof-of-concept has been identified, placing exploitation status at no public exploit identified at time of analysis. In real-world terms, risk is elevated in organizations with large EBS user bases where low-trust users (warehouse staff, external vendors with portal access, junior catalog editors) could abuse this to read or tamper with product data beyond their sanctioned scope, or disrupt Product Hub availability for other users. The flaw is not automatable at scale since it requires credential acquisition first. Priority should be moderate: patch within your next standard EBS maintenance window, with elevated urgency if EBS is accessible beyond trusted internal network segments.

An authenticated EBS user holding a minimal Product Hub role - for example, a read-only catalog viewer or a vendor portal user - sends crafted HTTP requests to the EBS application tier targeting the Role Based Security enforcement layer. By bypassing role-based access controls, the attacker reads product pricing or specification records restricted to higher-privileged roles, submits unauthorized modifications to catalog entries, or issues requests that cause partial disruption of Product Hub availability for concurrent users. No public proof-of-concept exists, so exploitation currently requires an attacker with knowledge of EBS internals and a valid low-privileged session.