Oracle Product Hub EUVD-2026-106217

Exploitation requires the attacker to possess a valid low-privileged account on Oracle Product Hub / E-Business Suite (PR:L - not remote-unauthenticated) and network HTTP access to the Item Catalog component of Oracle Product Hub versions 12.2.3 through 12.2.15. The CVSS vector marks AC:H, meaning exploitation is difficult and depends on conditions outside the attacker's control (e.g., specific state, timing, or configuration of the Item Catalog), which materially limits reliable exploitation. No user interaction is needed (UI:N). The key limiting factors defenders can rely on are: an authenticated foothold is mandatory, high attack complexity reduces reliability, and only the enumerated 12.2.x versions are affected; the offsetting risk amplifier is the scope change, which can extend impact to other Oracle products beyond Product Hub.

This is a genuinely high-priority vulnerability by composite signal, though not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L, base 7.7) tells a consistent story: network-reachable over HTTP, but with high attack complexity (AC:H) and requiring a low-privileged authenticated account (PR:L). The standout factor is the scope change (S:C) - Oracle explicitly states attacks may significantly impact additional products beyond Product Hub, which inflates the base score and reflects blast-radius risk across the E-Business Suite estate. No EPSS score was provided in the input, and there is no CISA KEV listing and no POC referenced, so there is no public exploit identified at time of analysis - real-world exploitation probability cannot be quantified from the supplied data. No SSVC decision data was provided. The signals are internally consistent (no CVSS-vs-description conflict), but the AC:H plus PR:L combination means exploitation is non-trivial and gated behind an existing foothold, so this is best treated as a prompt-patch item in Oracle's October 2026 CPU cycle rather than evidence of active mass exploitation. Note the input Tag 'Authentication Bypass' conflicts with the PR:L vector and the description's 'low privileged attacker' language, which implies authentication is required, not bypassed - treat that tag as suspect.

An attacker who already holds a low-privileged Oracle Product Hub / E-Business Suite application account sends crafted HTTP requests to the Item Catalog component to abuse the flaw. Because the vulnerability carries a scope change, a successful attack can pivot beyond Product Hub to read critical data across other accessible Oracle products, tamper with some data, and cause a partial denial of service. High attack complexity means the attacker must satisfy specific conditions or win a race/timing-dependent step; no public proof-of-concept was identified at time of analysis.