An exploitable flaw exists in Oracle Product Hub that allows a low‑privileged attacker with network access over HTTP to completely compromise the component, enabling them to take full control of Oracle Product Hub and affecting confidentiality, integrity and availability. The CVSS 3.1 score of 8.8 underscores the severity with an exploitability vector of network access, low required privileges, no user interaction and the impact across all data. The weakness aligns with an improper access control failure (CWE‑284).

The affected product is Oracle Product Hub, a component of Oracle E‑Business Suite, with versions ranging from 12.2.3 through 12.2.15. Only these releases are known to contain the vulnerability. No other Oracle products are listed as impacted.

The CVSS score of 8.8 places this in the high‑severity category, and the lack of a need for user interaction means the likelihood of exploitation is significant for anyone with network reach to HTTP. Although an EPSS score is not available, the high base score and networked nature of the attack vector suggest a realistic risk. The vulnerability is not yet listed in CISA KEV, but it is still exploitable and could be leveraged by threat actors to gain full control of the unhardened product hub.