Oracle Product Hub EUVD-2026-106311

Exploitation requires the attacker to already possess a low-privileged authenticated account (CVSS PR:L) with network HTTP access to the Oracle Product Hub component (Internal Operations) of an Oracle E-Business Suite deployment running an affected version in the 12.2.3-12.2.15 range. The key limiting factors are the authentication requirement (PR:L - not exploitable by fully unauthenticated attackers) and high attack complexity (AC:H), which Oracle describes as 'difficult to exploit,' implying conditions beyond the attacker's control or a non-trivial exploitation sequence must be met. No user interaction is required (UI:N). The scope change means a successful compromise is not confined to Product Hub and may significantly impact other connected Oracle products.

This is a genuinely high-severity issue (CVSS 3.1 8.5) but with meaningful friction to exploitation. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H combines remote network reachability (AV:N) and no user interaction (UI:N) with two risk-dampening factors: high attack complexity (AC:H, Oracle's own 'difficult to exploit' language) and a requirement for existing low-level privileges (PR:L). The scope change (S:C) plus full C:H/I:H/A:H and the stated 'takeover' outcome are what push the score to 8.5. Critically, several exploitation signals are absent from the input: no EPSS probability was provided, the CVE is NOT on CISA KEV, and no POC/public exploit is referenced - so this is 'no public exploit identified at time of analysis.' There is therefore no evidence of active or imminent widespread exploitation to contradict the high base score; this currently reads as a high-CVSS issue whose real-world urgency is tempered by AC:H and PR:L. The 'Information Disclosure' tag conflicts with the description, which asserts full takeover (C:H/I:H/A:H) and a scope change - treat that tag as understating impact rather than as authoritative. Prioritize patching in the October 2026 CPU cycle commensurate with an authenticated, complex but network-reachable takeover; it is not a drop-everything zero-day on current data.

An attacker who already holds a low-privilege authenticated account on the Oracle E-Business Suite instance sends crafted HTTP requests to the Oracle Product Hub (Internal Operations) component, exploiting the flaw to escalate to full takeover of Product Hub. Because of the scope change, the compromise can significantly affect additional connected Oracle products beyond Product Hub itself. No public exploit code is referenced, and the high attack complexity (AC:H) means reliable exploitation likely requires specialized conditions or effort.