Oracle Product Hub CVE-2026-61310

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged authenticated session (CVSS PR:L; Oracle tags the issue as an Authentication Bypass, meaning that low-privileged session is then leveraged to exceed its authorization within the Product Hub Internal Operations component). The target must be running an affected EBS release in the 12.2.3-12.2.15 range. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: the attacker cannot be fully unauthenticated - some valid credentials or account access are required - and reachability of the EBS/Product Hub HTTP endpoint from the attacker's network position is a prerequisite, so instances restricted to trusted internal networks materially reduce exposure.

This is a genuinely high-priority patch candidate for organizations running Oracle EBS 12.2. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes remote, low-complexity, no-user-interaction exploitation requiring only low privileges - a common profile for internal ERP users or any account that can authenticate to the application - and the description explicitly calls it 'easily exploitable.' Impact is severe on confidentiality and integrity (C:H/I:H) but absent on availability (A:N), so this is a data-exposure and data-tampering risk, not a service-outage risk. Signal completeness is limited: no EPSS score, no KEV status, and no POC were provided, so real-world exploitation likelihood cannot be quantified from the input - the 8.1 score reflects potential severity, not observed activity. The requirement for a valid low-privileged session is the main mitigating factor and means exposure is highest where the EBS instance is internet-facing or where low-trust users hold accounts.

An attacker who holds or obtains a low-privileged Oracle EBS account authenticates over HTTP and sends crafted requests to the Product Hub Internal Operations functionality, bypassing intended authorization to read and alter product master data across the application. Because no user interaction and only low privileges are required, a single compromised internal or partner account is sufficient to exfiltrate or tamper with all Product Hub-accessible data. No public POC or exploit code was identified in the source data.