Oracle Product Hub CVE-2026-83441

The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, authenticated, high-complexity flaw with severe data confidentiality and integrity consequences but no denial-of-service impact. Real-world priority is moderated by three factors: no CISA KEV listing, no identified public exploit code, and the AC:H rating, which means attackers cannot reliably reproduce the exploit without understanding Product Hub's internal state handling. EPSS data was not supplied in this intelligence set, so exploitation likelihood cannot be quantified - this should be checked independently. Note a signal mismatch worth flagging: the supplied tag 'Authentication Bypass' is not consistent with the PR:L vector, which requires an attacker to already hold a low-privileged account; the flaw is better characterized as an authorization/data-integrity weakness reachable by an authenticated low-privilege user. For most organizations the practical risk is an insider or compromised low-privilege account abusing Product Hub data rather than an unauthenticated external intrusion. Organizations with internet-facing EBS application tiers or large populations of low-privilege Product Hub users should treat this as a quarterly-patch priority.

An attacker who already holds a valid low-privilege Oracle Product Hub account - obtained through a phishing campaign, a compromised supplier portal credential, or a disgruntled insider - sends a sequence of deliberately crafted HTTP requests against the Internal Operations endpoints of the EBS application tier. Leveraging the high-complexity conditions, the attacker triggers the flaw to bypass the intended authorization boundary and then reads, creates, deletes, or modifies critical product master data, corrupting downstream procurement and order-management processes while leaving availability intact. No public proof-of-concept is identified at time of analysis, so the attacker must develop the exploit themselves.