EUVD-2026-79739
GHSA-cr8g-v66f-2228
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
HTTP-reachable but requires a low-privilege authenticated session and attacker-controlled complexity conditions, so PR:L and AC:H; full data confidentiality and integrity loss, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 6.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
AnalysisAI
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Risk Assessment | The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, authenticated, high-complexity flaw with severe data confidentiality and integrity consequences but no denial-of-service impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Oracle has published an advisory at https://www.oracle.com/security-alerts/cspusep2026.html - patch available per vendor advisory; apply the Product Hub fix referenced there, noting that Oracle EBS 12.2 patches are applied against the 12.2.x code line rather than as a version bump, so the affected range (12.2.3-12.2.15) remains the same after patching and patch-level verification via the EBS patch history is required. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today