Oracle Product Hub EUVD-2026-106216

Exploitation requires an authenticated attacker holding HIGH application privileges (PR:H) with network access to the Oracle Product Hub HTTP interface, targeting the Internal Operations component on affected E-Business Suite versions 12.2.3 through 12.2.15; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The dominant limiting factor is the high-privilege prerequisite: an anonymous or low-privileged user cannot exploit this, so realistic risk is confined to insiders, compromised privileged accounts, or chained post-authentication attacks. Standard EBS network exposure (HTTP reachability of the application tier) is the only deployment condition; no non-default feature toggle is named in the description.

This is a genuine but conditional priority. The CVSS 3.1 base score of 7.2 (High) reflects a network-reachable flaw (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N) that fully compromises confidentiality, integrity and availability (C:H/I:H/A:H) with scope unchanged (S:U) - the description's phrase 'takeover of Oracle Product Hub' is consistent with these impacts. The single most important limiting signal is PR:H: the vector and the description ('high privileged attacker') agree that the attacker must already hold high administrative privileges on the application, which substantially narrows the realistic threat to insiders, compromised privileged accounts, or chained post-authentication scenarios rather than anonymous internet attackers. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or available exploit code - exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS-vs-description conflict), but the absence of EPSS/KEV/POC means exploitation likelihood is currently unquantified; combined with the PR:H requirement, this reads as a high-severity-but-high-barrier issue that should be patched on Oracle's normal Critical Patch Update cadence rather than treated as an emergency, while recognizing that EBS is an attractive target where privileged credentials are a realistic acquisition for a motivated attacker.

An attacker who has already obtained a high-privileged Oracle Product Hub / E-Business Suite account (e.g., via credential theft, a malicious insider, or a prior privilege-gaining compromise) sends crafted HTTP requests to the Internal Operations component. With low complexity and no user interaction required, the requests exploit the flaw to achieve full compromise and takeover of the Oracle Product Hub application. No public exploit code is identified in the available data, so exploitation would require attacker-developed tooling.