What is the CVSS score of EUVD-2026-47477?

EUVD-2026-47477 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Product Hub are affected by EUVD-2026-47477?

Oracle E-Business Suite's Product Hub component (versions 12.2.3-12.2.15) contains a vulnerability that allows authenticated users with minimal system privileges to fully compromise the platform and…

How to fix or mitigate EUVD-2026-47477?

Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 and assess which host Product Hub or dependent applications; simultaneously restrict HTTP network access to Product Hub to administrative networks only and require multi-factor authentication for all accounts with system privileges. Within 7 days, deploy enhanced logging and real-time monitoring on authenticated sessions to Product Hub, focusing on privilege escalation attempts and unusual administrative activity; establish a cross-team review of low-privileged user access levels and remove unnecessary permissions. Within 30 days, initiate an upgrade path assessment to Oracle E-Business Suite versions outside the 12.2.3-12.2.15 range and document a timeline for patching or system replacement; in parallel, implement network-level controls to isolate Product Hub from dependent systems pending remediation.

Oracle Product Hub EUVD-2026-47477

| CVE-2026-61312 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hwmw-5r2x-m46g

Authentication Bypass Oracle Product Hub

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Authenticated HTTP access gives AV:N/PR:L; Oracle's 'difficult to exploit' maps to AC:H; stated cross-product impact and takeover justify S:C and C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:57 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Product Hub (formerly Product Information Management / PIM) is a master-data management application delivered as part of Oracle E-Business Suite, an integrated ERP/CRM/SCM platform running on the Oracle Application Server and Oracle Database stack. The affected 'Internal Operations' component handles server-side product data processing reachable over HTTP within the EBS application tier. Oracle did not assign a CWE (CWE: N/A) and the Critical Patch Update advisory does not disclose root-cause details; the vendor tag 'Information Disclosure' combined with full C/I/A impact and a scope change (S:C) suggests a server-side flaw where a compromise of the Product Hub context can cross a trust boundary into other EBS modules or the underlying platform, consistent with EBS's tightly integrated multi-module architecture.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to your Oracle E-Business Suite 12.2.x environment. Oracle ships EBS security fixes as cumulative CPU patches rather than a single renamed release, so identify and apply the specific Product Hub / Internal Operations patch listed in that advisory for your 12.2.3-12.2.15 level. Because exploitation requires an authenticated low-privileged account over HTTP, interim compensating controls until patching include restricting network access to the EBS application tier to trusted segments and VPN users, tightening role/responsibility assignments so fewer accounts can reach Product Hub Internal Operations functions, and adding WAF/monitoring on HTTP traffic to those endpoints; these controls reduce exposure but do not remove the flaw and may disrupt legitimate integrations that rely on broad Product Hub access.