Product Hub
Monthly
Improper access controls in Oracle Product Hub, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, let a low-privileged authenticated user reach Internal Operations functionality over HTTP and obtain unauthorized read access to critical product data plus limited insert, update, or delete access to some records. Oracle's own advisory rates this CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a valid but unprivileged account is enough — no user interaction and no elevated role required. No public exploit code and no CISA KEV listing were identified at time of analysis, but Oracle CPU vulnerabilities in E-Business Suite are historically attractive to attackers because the targets are internet-exposed, data-rich ERP systems.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
In Oracle Product Hub — the product information management module of Oracle E-Business Suite — the Internal Operations component mishandles authorization, letting a low-privileged user who can reach the application over HTTP create, delete or modify critical records and read all Product Hub data they should not see. Every supported release from 12.2.3 through 12.2.15 is affected; the flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H/A:N) with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle rates it 'easily exploitable' and a routine authenticated HTTP request is the only delivery mechanism needed.
Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authorization weakness in the Internal Operations component that lets a low-privileged attacker with network access over HTTP read, create, modify, or delete critical Product Hub data beyond their intended privileges. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction is required but a valid low-privileged account is. No public exploit code and no CISA KEV listing were identified at time of analysis; the only authoritative source is Oracle's Critical Security Patch Update advisory (cspusep2026).
Oracle Product Hub, a module of Oracle E-Business Suite (Item Catalog component), versions 12.2.3 through 12.2.15, allows an authenticated low-privileged attacker with HTTP network access to retrieve data beyond their authorized scope, including critical item and catalog data, with the compromise potentially spilling into other E-Business Suite products (scope change). Oracle rates this CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV, though the low attack complexity and required low privilege level keep it attractive for an insider or a compromised low-privilege ERP account.
Oracle Product Hub, the product information management component of Oracle E-Business Suite (Item Catalog module), exposes critical item data to any low-privileged authenticated user who can reach the application over HTTP in versions 12.2.3 through 12.2.15. An attacker with a valid but minimal account can send crafted requests that return data far outside their assigned responsibilities, and Oracle notes the compromise can extend into other, interconnected E-Business Suite products (scope change). Oracle rates this 7.7 with a confidentiality-only impact; no public exploit code or CISA KEV entry is available at time of analysis, so exploitation would currently require an attacker who already holds or can obtain a low-privilege account.
Oracle E-Business Suite's Product Hub module (Item Catalog component) in versions 12.2.3 through 12.2.15 exposes critical item data to any authenticated low-privileged user who can reach the application over HTTP. A successful attack grants unauthorized read access to Product Hub data and, per Oracle's scope-change assessment, can also affect other EBS products sharing the same data and session context. Only confidentiality is impacted (no integrity or availability effect), and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.
Authenticated low-privilege users of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.14 can exploit a flaw in the Item Catalog component over HTTP to read, create, modify, or delete critical item master data, yielding high confidentiality and integrity impact. The vulnerability is remotely reachable with low attack complexity and no user interaction, though it requires a valid EBS account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). EPSS is low at 0.38% (30th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a serious but not emergency-tier issue, with exposure limited to environments where Product Hub is provisioned and the EBS HTTP interface is network-reachable.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Template, GTIN search). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Improper access controls in Oracle Product Hub, a module of Oracle E-Business Suite 12.2.3 through 12.2.15, let a low-privileged authenticated user reach Internal Operations functionality over HTTP and obtain unauthorized read access to critical product data plus limited insert, update, or delete access to some records. Oracle's own advisory rates this CVSS 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), meaning a valid but unprivileged account is enough — no user interaction and no elevated role required. No public exploit code and no CISA KEV listing were identified at time of analysis, but Oracle CPU vulnerabilities in E-Business Suite are historically attractive to attackers because the targets are internet-exposed, data-rich ERP systems.
Full takeover of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 is achievable by a low-privileged attacker who can reach the module's HTTP interface, with CVSS 8.8 reflecting high confidentiality, integrity, and availability impact across the whole affected application. Exploitation requires only a valid low-privileged EBS session and network access to HTTP — no user interaction and no administrative privileges. No public exploit code or CISA KEV entry was identified at time of analysis, and Oracle's Critical Security Patch Update at oracle.com/security-alerts/cspusep2026.html is the only patch reference provided.
In Oracle Product Hub — the product information management module of Oracle E-Business Suite — the Internal Operations component mishandles authorization, letting a low-privileged user who can reach the application over HTTP create, delete or modify critical records and read all Product Hub data they should not see. Every supported release from 12.2.3 through 12.2.15 is affected; the flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H/A:N) with no user interaction required. No public exploit code or CISA KEV entry was identified at time of analysis, but Oracle rates it 'easily exploitable' and a routine authenticated HTTP request is the only delivery mechanism needed.
Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.15 exposes an authorization weakness in the Internal Operations component that lets a low-privileged attacker with network access over HTTP read, create, modify, or delete critical Product Hub data beyond their intended privileges. The flaw carries a CVSS 3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), meaning no user interaction is required but a valid low-privileged account is. No public exploit code and no CISA KEV listing were identified at time of analysis; the only authoritative source is Oracle's Critical Security Patch Update advisory (cspusep2026).
Oracle Product Hub, a module of Oracle E-Business Suite (Item Catalog component), versions 12.2.3 through 12.2.15, allows an authenticated low-privileged attacker with HTTP network access to retrieve data beyond their authorized scope, including critical item and catalog data, with the compromise potentially spilling into other E-Business Suite products (scope change). Oracle rates this CVSS 3.1 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) — confidentiality-only impact with no integrity or availability effect. There is no public exploit identified at time of analysis and the issue does not appear in CISA KEV, though the low attack complexity and required low privilege level keep it attractive for an insider or a compromised low-privilege ERP account.
Oracle Product Hub, the product information management component of Oracle E-Business Suite (Item Catalog module), exposes critical item data to any low-privileged authenticated user who can reach the application over HTTP in versions 12.2.3 through 12.2.15. An attacker with a valid but minimal account can send crafted requests that return data far outside their assigned responsibilities, and Oracle notes the compromise can extend into other, interconnected E-Business Suite products (scope change). Oracle rates this 7.7 with a confidentiality-only impact; no public exploit code or CISA KEV entry is available at time of analysis, so exploitation would currently require an attacker who already holds or can obtain a low-privilege account.
Oracle E-Business Suite's Product Hub module (Item Catalog component) in versions 12.2.3 through 12.2.15 exposes critical item data to any authenticated low-privileged user who can reach the application over HTTP. A successful attack grants unauthorized read access to Product Hub data and, per Oracle's scope-change assessment, can also affect other EBS products sharing the same data and session context. Only confidentiality is impacted (no integrity or availability effect), and no public exploit code or CISA KEV entry was identified in the supplied intelligence at time of analysis.
Oracle Product Hub, a module of Oracle E-Business Suite, contains a flaw in its Internal Operations component that lets a low-privileged attacker with HTTP network access take over the Product Hub application. Supported releases 12.2.3 through 12.2.15 are affected, and successful exploitation yields high confidentiality, integrity and availability impact across the module. No public exploit code has been identified and the issue is not listed in CISA KEV at time of analysis, though Oracle treats this class of flaw as remotely exploitable and easily abused, making prompt patching of internet- or intranet-exposed E-Business Suite deployments important.
Oracle Product Hub, the product master-data module of Oracle E-Business Suite, fails to properly enforce authorization in its Internal Operations component across supported releases 12.2.3 through 12.2.15, allowing an attacker who already holds a high-privileged account to achieve full takeover of the module over HTTP. Successful exploitation yields complete confidentiality, integrity and availability impact (CVSS 3.1 base 7.2, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning master data, configuration and administrative functions can be read and altered. Oracle did not publish a CWE identifier with this record, no public exploit code has been identified at time of analysis, and neither CISA KEV nor EPSS data was supplied, so active exploitation cannot be confirmed.
Takeover of Oracle Product Hub in Oracle E-Business Suite 12.2.3 through 12.2.15 is possible for a highly privileged authenticated attacker with network HTTP access to the Internal Operations component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.2). The flaw is rated easily exploitable (AC:L, UI:N) once the required credentials are held, and no public exploit has been identified at time of analysis. Because the CVSS vector specifies PR:H, anonymous or low-privileged internet attackers are ruled out, leaving the mandatory high-privilege account as the primary gating factor.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a full system takeover path via a network-accessible flaw in its Outbound Data component, exploitable by any low-privileged authenticated user over HTTP with no user interaction required. Oracle classifies this as 'easily exploitable' and confirms complete confidentiality, integrity, and availability compromise upon successful exploitation. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, but the low attack complexity warrants urgent remediation for all affected deployments.
Full compromise of Oracle Product Hub (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows an authenticated, low-privileged attacker with HTTP network access to take over the product and, because of a scope change, significantly impact additional connected products. The flaw was disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 score of 8.5, though the vector rates it as difficult to exploit (AC:H). No public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-based takeover of Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) allows a low-privileged, network-authenticated attacker to fully compromise the product via HTTP. Affected releases span EBS 12.2.3 through 12.2.15, and the CVSS 3.1 vector (8.8) reflects high confidentiality, integrity, and availability impact with low attack complexity. No public exploit identified at time of analysis; disclosed through Oracle's July 2026 Critical Patch Update.
Unauthorized data compromise in Oracle Product Hub (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the Product Hub application. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle tags it as an Authentication Bypass. There is no public exploit identified at time of analysis and no CISA KEV listing, but it is addressed in Oracle's July 2026 Critical Patch Update.
Oracle Product Hub, the product master-data component of Oracle E-Business Suite (versions 12.2.3 through 12.2.15), is exposed to a difficult-to-exploit flaw in its Internal Operations component that lets a low-privileged, network-positioned attacker read and tamper with critical product data via HTTP. The CVSS 3.1 base score is 6.8 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact but no availability impact, with the high attack-complexity metric indicating exploitation depends on conditions outside the attacker's direct control. There is no public exploit identified at time of analysis and the flaw has not been listed in CISA KEV; Oracle's own advisory at cspusep2026.html is the authoritative remediation source.
Oracle Product Hub versions 12.2.3 through 12.2.15, part of Oracle E-Business Suite, exposes a flaw in its Role Based Security component that allows a low-privileged, network-authenticated attacker to exceed their authorized data access via HTTP. Successful exploitation yields unauthorized read access to a subset of product catalog data, unauthorized insert, update, or delete operations on accessible records, and the ability to cause partial denial of service within the Product Hub module. No public exploit code or CISA KEV listing has been identified at time of analysis; Oracle disclosed this through the July 2026 Critical Patch Update.
Oracle Product Hub's Item Catalog component in E-Business Suite versions 12.2.3 through 12.2.15 exposes an easily exploitable flaw allowing low-privileged, authenticated HTTP network attackers to compromise item master data. Successful exploitation yields unauthorized read access to a subset of Product Hub data, unauthorized data modification or deletion, and partial denial of service against the Product Hub component. No public exploit identified at time of analysis, and Oracle classified this as 'easily exploitable' in its July 2026 Critical Patch Update.
Authenticated low-privilege users of Oracle Product Hub within Oracle E-Business Suite 12.2.3 through 12.2.14 can exploit a flaw in the Item Catalog component over HTTP to read, create, modify, or delete critical item master data, yielding high confidentiality and integrity impact. The vulnerability is remotely reachable with low attack complexity and no user interaction, though it requires a valid EBS account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1). EPSS is low at 0.38% (30th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis; this is a serious but not emergency-tier issue, with exposure limited to environments where Product Hub is provisioned and the EBS HTTP interface is network-reachable.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Template, GTIN search). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.