Oracle Product Hub EUVD-2026-106250

Exploitation requires the attacker to hold a valid low-privileged account on an affected Oracle E-Business Suite instance (PR:L) and network access to the Product Hub (Internal Operations) component over HTTP; affected versions are Oracle Product Hub 12.2.3 through 12.2.15. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the attacker can act unassisted. The primary limiting factors are the authentication requirement (not exploitable by fully anonymous external users per the vector) and version applicability (only the 12.2.3-12.2.15 range); no special non-default configuration or feature-enablement condition is stated in the Oracle description.

This is a genuine high-priority vulnerability, not merely a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) indicates network-reachable exploitation over HTTP with low attack complexity, no user interaction, and only low privileges required, yielding full confidentiality, integrity, and availability compromise (described by Oracle as 'takeover of Oracle Product Hub'). The one strong limiting signal is PR:L: an attacker needs an authenticated (even low-privilege) account on the EBS instance, which constrains purely external anonymous attacks but is a low bar in large enterprises with many internal/self-service accounts. Key exploitation-maturity signals are MISSING from the provided data: no EPSS score, no CISA KEV listing, and no POC indicator were supplied, so real-world exploitation probability cannot be quantified from this input - it is currently 'no public exploit identified at time of analysis.' No SSVC decision data was provided. One conflict to note: the input Tag 'Information Disclosure' understates the vulnerability, since the CVSS vector and Oracle description specify full I:H and A:H (takeover), not read-only disclosure - treat the tag as inaccurate and rely on the CIA impacts. Given EBS's exposure in enterprise environments and the ease of exploitation for any authenticated user, this warrants prompt patching via the October 2026 CPU despite the absence of confirmed in-the-wild activity.

A low-privileged user with a valid Oracle E-Business Suite account (or an attacker who has obtained such credentials) sends crafted HTTP requests to the Product Hub (Internal Operations) component. Because attack complexity is low and no user interaction is needed, the request triggers the flaw and escalates to full compromise ('takeover') of Oracle Product Hub, giving the attacker read/write control and the ability to disrupt availability. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector rather than a demonstrated PoC.