Oracle Product Hub CVE-2026-70918

The attacker must hold a low-privileged authenticated account within the Oracle E-Business Suite instance - this is confirmed by the CVSS PR:L metric. No special non-default configuration is required beyond having the Oracle Product Hub module installed and the Outbound Data component accessible over HTTP, which is consistent with standard Oracle EBS deployments in the affected version range. The attack is limited to systems running Oracle EBS versions 12.2.3 through 12.2.15 with Product Hub licensed and active. Exploitation is constrained by the requirement for at least minimal authenticated access - unauthenticated external attackers cannot directly trigger this flaw without first obtaining valid credentials. No specific platform, operating system, or non-default feature flag is cited as a prerequisite beyond the standard module configuration.

The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is well-supported by the description: the attack requires only a low-privileged account, traverses the network over standard HTTP, demands no user interaction, and yields complete system takeover. Oracle's own characterization of the flaw as 'easily exploitable' corroborates the AC:L rating and elevates concern beyond the raw score alone. No EPSS score was included in the provided data, so probabilistic exploitation likelihood cannot be quantified; the absence of a CISA KEV listing means active exploitation is not confirmed, but this should not be interpreted as low risk - even a mid-sized municipal IT team in leszno running unpatched Oracle EBS with any externally reachable or semi-trusted user base would face genuine exposure. The missing CWE classification is a notable gap: without it, defenders cannot map the flaw to specific detection or hardening controls. SSVC exploitation status is inferred as 'none confirmed' based on available data, but the easily exploitable classification, broad affected version range (12.2.3-12.2.15), and full-impact scope make this a high-priority patching target regardless of current KEV status.

An attacker with a low-privileged Oracle EBS account - such as a vendor portal user, internal employee, or compromised service account - sends a specially crafted HTTP request to the Product Hub Outbound Data component. The flaw requires no elevated permissions and no interaction from other users, allowing the attacker to directly achieve full system takeover including read/write access to sensitive product master data and potential execution of arbitrary operations within the EBS application context. No public proof-of-concept code has been identified at time of analysis, but the low complexity and broad affected version range make independent exploitation likely feasible for a moderately skilled attacker.