Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Network
Action: Immediate Patch
AI Analysis

Impact

An easily exploitable flaw in Oracle Product Hub allows a low‑privileged attacker with network access to compromise the application. The vulnerability, classified under CWE‑284 (Improper Access Control) and CWE‑20 (Improper Input Validation), enables the attacker to take full control of the hub, resulting in confidentiality, integrity, and availability loss.

Affected Systems

Oracle Corporation’s product, Oracle Product Hub, part of Oracle E‑Business Suite for Internal Operations. Supported, affected versions are 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 indicates high impact. Because the attack vector is network‑based with low privileges and requires no user interaction, the likely attack path is an external HTTP request to the hub that exploits the access control flaw or input validation failure. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation activity is not publicly confirmed but remains feasible.

Generated by OpenCVE AI on October 21, 2026 at 03:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Product Hub patch or upgrade to a supported version newer than 12.2.15
  • Configure network firewall rules to restrict HTTP access to the hub to trusted internal hosts only
  • Review and enforce least‑privilege credentials for all accounts with access to the Product Hub

Generated by OpenCVE AI on October 21, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege Network HTTP Exploit Compromises Oracle Product Hub
Weaknesses CWE-20
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:49.358Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101852

cve-icon Vulnrichment

Updated: 2026-10-29T10:41:11.522Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:41.177

Modified: 2026-10-29T11:17:22.547

Link: CVE-2026-101852

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:00:08Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-284

    Improper Access Control