EUVD-2026-46508
GHSA-pwqx-3wf6-xcjg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege EBS credentials
-
DeliveryReach Product Hub HTTP endpoint
-
ExploitSend crafted Item Catalog request
-
ExecutionBypass authorization scope
-
ImpactRead or modify all catalog data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle E-Business Suite web tier over HTTP and a low-privileged authenticated session (CVSS PR:L), with no user interaction needed; the target must be running Oracle Product Hub Item Catalog on EBS 12.2.3-12.2.15. Limiting factors: the attacker must already possess valid low-level EBS credentials and be able to reach the Product Hub HTTP endpoint, so instances where the EBS web tier is not internet-exposed and account provisioning is tightly controlled substantially reduce realistic exposure. Note the vendor 'Authentication Bypass' tag conflicts with PR:L - if some access can occur without authentication, the condition weakens to network reachability alone, which should be confirmed with Oracle. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N describes a network-reachable, low-complexity attack requiring some (low) privileges and no user interaction, yielding high confidentiality and integrity impact but no availability impact - Oracle explicitly rates it 'easily exploitable.' There is no EPSS score, POC, or SSVC data in the provided input, and it is not in CISA KEV, so there is no evidence of active exploitation and no public exploit; risk today rests on the vector alone. The 'Authentication Bypass' tag appears to conflict with the PR:L metric, which states the attacker must already hold low-level credentials - verify with the vendor whether pre-authentication access is possible, as that would materially raise urgency. Overall this is a genuinely high-priority patch-cycle item for organizations running EBS Product Hub (authenticated attacker can fully compromise catalog data integrity and confidentiality), but absent KEV/EPSS signals it is a prioritize-in-normal-CPU-remediation item rather than a confirmed emergency. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege Oracle E-Business Suite account (or obtains one via phishing or a weak self-service login) sends crafted HTTP requests to the Product Hub Item Catalog interface and reads or alters item master data beyond their authorized scope. Because no user interaction and only low complexity are required, the attacker could silently exfiltrate sensitive catalog data or corrupt/delete critical product records. No public exploit code is currently identified, so this would require independent development against the EBS interface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.
RemediationAI
Apply the fix from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle delivers EBS 12.2 fixes as CPU patches layered on the applicable 12.2.x codelevel rather than as a single named version, so identify and apply the CPU patch that corresponds to your installed release between 12.2.3 and 12.2.15. Because exploitation requires network HTTP access with low privileges, compensating controls until patching include restricting EBS web-tier exposure to trusted networks/VPN and placing it behind a WAF or reverse proxy, tightening Product Hub / Item Catalog role and responsibility assignments to limit which authenticated users can reach the component, and increasing audit logging on catalog data changes to detect unauthorized create/delete/modify activity - noting that access restrictions may inconvenience legitimate remote users and are only a stopgap, not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Product Hub is the master-data / product information management (PIM) module of Oracle E-Business Suite, and the affected surface is its Item Catalog component, which manages item definitions, categories, and attributes. The vulnerability is exposed over the EBS web tier via HTTP, meaning it is reachable through the standard Oracle Application Server / OA Framework front end that fronts the underlying database. Oracle did not assign a CWE (CWE: N/A), but the CVSS profile (authenticated attacker gaining full read and write over all module-accessible data with no availability loss) combined with the vendor 'Authentication Bypass' tag is consistent with a broken access-control / authorization-flaw class where a low-privilege session can reach data and operations beyond its intended scope. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_product_hub:*, spanning the 12.2.x code line.
Know when Oracle Product Hub gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network HTTP reachability with a low-privilege account and no user interaction gives AV:N/AC:L/PR:L/UI:N; full read/write over module data yields C:H/I:H, with no availability impact so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Product Hub in E-Business Suite versions 12.2.3-12.2.15 contains a high-severity access control flaw allowing low-privileged users to read, modify, and delete product catalog data. This directly threatens data integrity, supply chain operations, and regulatory compliance for affected organizations.
Apply vendor patch: Oracle E-Business Suite July 2026 Critical Patch Update. Interim controls pending patch deployment: restrict HTTP access to Product Hub to authenticated administrative users only, implement network segmentation to limit exposure, and enable comprehensive audit logging of all Product Hub data operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB