EUVD-2026-79458
GHSA-4vm7-36mf-w73m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege EBS account
-
ExploitSend crafted HTTP request to Site Hub
-
ExecutionExploit Internal Operations flaw
-
ImpactCreate/modify/delete critical Site Hub data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privileged account on an Oracle E-Business Suite instance running the Site Hub product (versions 12.2.3 through 12.2.15) with the Internal Operations component reachable over HTTP; no user interaction is needed. Exploitation is limited by the authentication requirement (PR:L) - an anonymous internet attacker cannot exploit it without first obtaining credentials - and by the narrow deployment of the Site Hub module within EBS. Impact is confined to integrity (full write/delete of Site Hub data) and limited confidentiality (subset read); there is no availability impact. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) describes an easily exploitable, network-reachable flaw that nevertheless requires an authenticated low-privileged account (PR:L) - it is NOT a true pre-auth issue despite the 'Authentication Bypass' tag. Impact is skewed toward integrity (I:H: unauthorized create/delete/modify of critical Site Hub data) with only partial confidentiality (C:L: read access to a subset of data) and no availability impact (A:N). No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or imminent exploitation. This is a genuinely high-integrity-impact bug but its real-world priority is tempered by the authentication requirement and the niche module footprint; treat it as a standard-priority patch within the Oracle CPU cycle rather than an emergency. Note the conflict: the 'Authentication Bypass' tag contradicts the PR:L vector - the vector should be trusted, and exploitation requires valid low-privilege credentials. |
| Exploit ScenarioDerived | A low-privileged authenticated user of an Oracle E-Business Suite deployment sends crafted HTTP requests to the Site Hub Internal Operations component, abusing the flaw to create, modify, or delete critical Site Hub data and read a subset of accessible records. No public exploit code has been identified, and the attack requires an existing valid account, so realistic risk is highest from malicious insiders or attackers who have already obtained low-level credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Integrity compromise in Oracle Site Hub, a module of Oracle E-Business Suite, affects supported releases 12.2.3 through 12.2.15 and lets a low-privileged authenticated attacker reach the Internal Operations component over HTTP to create, delete, or modify critical Site Hub data while also reading a subset of that data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, base 7.1) confirms network reachability with no user interaction, but the PR:L metric means credentials are required, so this is not a pre-auth or anonymous attack path despite the 'Authentication Bypass' tag carried by the reporting feed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and exploitation is further constrained by the relatively narrow deployment footprint of the Site Hub module within EBS.
RemediationAI
Apply the Oracle Critical Security Patch Update published at https://www.oracle.com/security-alerts/cspusep2026.html for the affected Oracle E-Business Suite 12.2.3-12.2.15 installation; the available source data identifies the advisory as the vendor fix reference but does not specify an exact patch version, so confirm the required EBS patch level (release update / one-off patch) for your specific 12.2.x code level against that advisory before scheduling the outage (patch available per vendor advisory). Until patched, the most effective compensating control follows directly from the PR:L prerequisite: enforce least privilege and aggressively review low-privileged EBS accounts with access to the Site Hub module, disabling or expiring dormant, shared, and default accounts, with the trade-off that legitimate Site Hub operators must receive equivalent-but-minimal responsibility assignments and may need workflow adjustments. Because the component is reachable over HTTP (AV:N), restrict network exposure of the EBS application tier and the Site Hub Internal Operations endpoints to trusted networks or VPN and place them behind a WAF/access proxy, accepting the trade-off that this complicates remote or partner access and can break integrations if not scoped by source address. Additionally, enable EBS audit trails (sign-on audit, forms-level auditing, and database auditing on Site Hub tables) so unauthorized create/delete/modify activity is detected, recognizing that audit logging adds database overhead; monitor the Oracle advisory channel for an updated fix reference and re-validate the patch level once a specific patch version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Site Hub is an optional Oracle E-Business Suite application module used for site, location, and party-site data management; the vulnerable code path sits in its Internal Operations component, which is exposed through the standard EBS HTTP/HTML interface. No CWE is assigned in the source data, but the described behavior - unauthorized create/delete/modify of critical data plus limited unauthorized read - is a broken access control / missing authorization class of defect, where an authenticated session holding only low privileges can drive operations that should require elevated entitlements. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N indicates the flaw is trivially triggered once a valid low-privileged EBS account exists, requires no victim interaction, stays within the same security scope, and produces a high integrity impact with a partial confidentiality impact and no availability impact. The independent assessment explicitly notes that the 'Authentication Bypass' tag from the reporting feed should not be read as pre-authentication exploitation: PR:L in the authoritative vector is the governing signal, and access to the Internal Operations component over HTTP from a provisioned account is a prerequisite.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Network HTTP with low complexity but requires an authenticated low-privilege account (PR:L); high integrity write/delete, partial confidentiality read, no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Site Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Site Hub accessible data as well as unauthorized read access to a subset of Oracle Site Hub accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Executive ViewAI
Oracle E-Business Suite customers running the Site Hub module on releases 12.2.3 through 12.2.15 face an unpatched integrity weakness that lets someone who already holds valid EBS credentials reach the Internal Operations component over the network and tamper with - or delete - Site Hub master data, with limited read access as well. The business exposure is corruption of the operational and site records that downstream EBS processes and reporting depend on, so finance, supply chain, and site operations teams could be acting on falsified data before anyone notices. Leadership should care because remediation currently depends entirely on interim controls and monitoring rather than a vendor fix, and the affected module is typically deployed to a limited subset of the EBS user population, which makes targeted abuse harder to spot.
No vendor-released patch is available. Interim mitigations: restrict network and web-tier access to the Internal Operations component so only required internal sources and accounts can reach it; minimize the EBS user population holding Site Hub responsibilities and enforce least privilege; enable EBS and database auditing on Site Hub tables with alerting on create, delete, and modify activity; monitor for anomalous or out-of-hours changes; and periodically reconcile Site Hub data against trusted downstream sources to detect tampering. Track Oracle's Critical Patch Update cycle for the eventual fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB