Oracle Product Hub EUVD-2026-47456

Exploitation requires a valid authenticated session with at minimum low-privileged access to the Oracle E-Business Suite instance, confirmed by the CVSS PR:L metric. The attacker must have HTTP network access to the EBS web tier hosting the Product Hub Item Catalog component, confirmed by AV:N. No user interaction from a victim is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions or special environmental configurations need to be satisfied beyond authenticated network access. Exploitation is strictly limited by the authentication requirement - unauthenticated external attackers cannot exploit this directly without first obtaining valid EBS credentials. The unchanged scope (S:U) means compromise is bounded to the Product Hub component and does not cascade to the underlying database server or other EBS modules through this vulnerability alone. No specific non-default configuration or feature toggle is identified as a prerequisite in the available description.

The CVSS 3.1 Medium score of 6.3 reflects a network-accessible, low-complexity attack requiring only a low-privileged account and no user interaction, with partial impacts across all three CIA pillars. Oracle's own characterization of this as 'easily exploitable' reinforces the low AC:L/PR:L metrics - any valid EBS user can attempt exploitation without special tooling. However, all impact metrics are rated Low (C:L/I:L/A:L), constraining the blast radius to partial data disclosure, limited data manipulation, and intermittent disruption rather than full system compromise. No EPSS score is available in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no known POC code, suggesting exploitation remains theoretical at time of analysis. The real-world priority is moderate: the ease of exploitation by any authenticated insider or compromised low-privilege account is the primary concern, but the limited scope change (S:U) and low impact ratings reduce urgency relative to higher-severity EBS vulnerabilities in the same CPU cycle.

An authenticated low-privileged EBS user - such as a read-only catalog viewer or a supplier portal account - submits a crafted HTTP request to the Product Hub Item Catalog endpoint, exploiting the authorization weakness to elevate their data access. The attacker reads item records they should not have access to, modifies or deletes catalog entries to disrupt product data integrity, and triggers intermittent availability degradation of the Product Hub service for other users. No public exploit code is known at time of analysis, so exploitation would currently require custom tooling or manual request crafting.