Oracle Product Hub CVE-2026-61312

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L - authenticated per CVSS) with HTTP network reach to the Product Hub Internal Operations component; it is not reachable by fully unauthenticated attackers. The high attack complexity (AC:H) signals a real limiting factor - a specific condition, timing, or configuration/state outside the attacker's control must be met - so exploitation is not reliable against arbitrary requests. No user interaction is needed (UI:N). Applicability is limited to EBS 12.2.3 through 12.2.15 running the Product Hub module; environments without Product Hub deployed or on unaffected releases are not exposed. The precise triggering feature or setting is not disclosed in the Oracle CPU summary and should be confirmed with the vendor.

The CVSS 3.1 base score of 8.5 is driven largely by the scope change (S:C) and full confidentiality, integrity, and availability impact (C:H/I:H/A:H), not by ease of exploitation: the vector requires high attack complexity (AC:H) and low privileges (PR:L / authenticated), which materially lowers real-world exploitability compared with a network-unauthenticated flaw. No EPSS score, POC, or SSVC decision data was provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation - this reads as a high-severity-on-paper issue gated by attacker prerequisites (valid credentials plus a difficult-to-satisfy exploitation condition). Note a discrepancy to verify: the vendor 'Information Disclosure' tag is narrower than the full I:H/A:H claimed by the CVSS vector, so the true impact breadth should be confirmed against Oracle's advisory rather than assumed from the tag.

An attacker who has obtained a low-privileged Oracle E-Business Suite account (via phishing, credential reuse, or an insider) sends specially crafted HTTP requests to the Product Hub Internal Operations component. By satisfying the specific difficult-to-meet condition (AC:H), they escalate to full takeover of Product Hub and, via the scope change, pivot to impact additional connected EBS products or platform components. No public exploit is currently known, so this would require original exploit development.