What is the CVSS score of EUVD-2026-47475?

EUVD-2026-47475 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Product Hub are affected by EUVD-2026-47475?

Oracle Product Hub (E-Business Suite) versions 12.2.3-12.2.15 contain an authentication bypass vulnerability (CVSS 8.1) that enables low-privileged users to read, modify, and delete all data…

How to fix or mitigate EUVD-2026-47475?

Within 24 hours, audit all Oracle E-Business Suite deployments to identify systems running Product Hub versions 12.2.3 through 12.2.15 and document current user privilege levels in the Product Hub application. Within 7 days, obtain and apply Oracle's July 2026 Critical Patch Update to all affected instances after testing in a staging environment to verify deployment success. By 30 days, review authentication and data access logs for unauthorized activity during the exposure window, audit any data modifications by low-privileged accounts, and implement enhanced monitoring for Product Hub data access.

Oracle Product Hub EUVD-2026-47475

| CVE-2026-61310 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vhjj-v64m-qc84

Authentication Bypass Oracle Product Hub

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote HTTP access with a low-privileged session (PR:L) and no user interaction yields high confidentiality and integrity loss over all Product Hub data, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Product Hub is the master data / product information management (PIM) module of Oracle E-Business Suite, Oracle's on-premises ERP suite, and the affected code lives in the Internal Operations component. Oracle's own tagging labels this an 'Authentication Bypass', which aligns with the CVSS PR:L requirement of only a low-privileged authenticated session and the resulting broad C:H/I:H impact - a signed-in user can reach and manipulate data beyond their intended authorization boundary within Product Hub. No CWE was assigned in the source data, but the authentication-bypass tag and the create/delete/modify-plus-read impact pattern are consistent with a broken access control / improper authorization weakness (CWE-284/CWE-863 class) rather than memory corruption. The affected releases (12.2.3-12.2.15) are all point releases of the EBS 12.2 code line, indicating the defect spans the entire supported 12.2 branch.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (patch available per vendor advisory) - Oracle ships EBS security fixes as CPU patches rather than a single renamed release, so identify the exact patch for your 12.2.x level from https://www.oracle.com/security-alerts/cpujul2026.html and apply it after testing. No standalone fixed version number is given in the input beyond 'through 12.2.15', so pull the precise patch identifier from the CPU advisory; do not assume an upgrade past 12.2.15 is available. Until patching completes, reduce exposure by ensuring the EBS instance is not reachable from the public internet, restricting network/HTTP access to the Product Hub and Internal Operations endpoints to trusted internal segments (accepting that this may block legitimate remote or partner users), and tightening account provisioning and reviewing low-privilege user roles since exploitation requires only an authenticated low-privileged session (with the trade-off of added access-management overhead). Increase auditing/monitoring of Product Hub data create/delete/modify operations to detect abuse in the interim.