Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: High Privilege Remote Takeover
Action: Patch Immediately
AI Analysis

Impact

The Oracle Product Hub component of Oracle E‑Business Suite is vulnerable to an easily exploitable flaw that allows an attacker with high privileged network access over HTTP to compromise the application. Successful exploitation results in full takeover, compromising confidentiality, integrity, and availability of the Product Hub. The vulnerability is documented with a CVSS v3.1 base score of 7.2 indicating high severity.

Affected Systems

Affected systems include Oracle Corporation’s Oracle Product Hub used within Oracle E‑Business Suite. The vulnerability impacts supported versions ranging from 12.2.3 to 12.2.15. Downgrading to earlier, non‑affected releases is possible but not recommended due to lifecycle concerns.

Risk and Exploitability

The security risk is moderate to high, reflected by the CVSS score of 7.2. The EPSS score is not available, but the flaw is considered easily exploitable. The attack vector is network-based via HTTP, requiring a high‑privileged attacker. The flaw is not listed in the CISA KEV catalog, but the impact could be severe if an attacker gains early access. Compromise would allow an attacker to take complete control of the Oracle Product Hub.

Generated by OpenCVE AI on October 21, 2026 at 02:06 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Product Hub security patch that fixes the high‑privileged HTTP exploit for versions 12.2.3 through 12.2.15.
  • Restrict HTTP access to the Product Hub to trusted internal hosts or VPN tunnels, blocking public internet exposure.
  • Enable comprehensive audit logging for all Product Hub operations and review logs regularly for signs of unauthorized activity.
  • Verify that role‑based access controls enforce least privilege and remove any excessive permissions that could aid an attacker.
  • If feasible, disable or restrict exposed management interfaces that are not required for normal operation.

Generated by OpenCVE AI on October 21, 2026 at 02:06 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Title High Privilege HTTP Exploit Compromise in Oracle Product Hub
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T15:14:36.257Z

Reserved: 2026-09-28T15:40:09.508Z

Link: CVE-2026-101816

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:37.583

Modified: 2026-10-22T16:17:18.963

Link: CVE-2026-101816

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T19:15:15Z

Weaknesses