Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution leading to full takeover of Oracle Product Hub
Action: Immediate patch
AI Analysis

Impact

The vulnerability allows a low‑privileged network attacker to exploit Oracle Product Hub via HTTP, resulting in a full compromise of the application. The effect includes loss of confidentiality, integrity, and availability, and the potential for the attacker to take control of the entire application layer.

Affected Systems

Oracle E‑Business Suite customers running Oracle Product Hub versions 12.2.3 through 12.2.15, part of the Internal Operations component, are affected.

Risk and Exploitability

The CVSS base score of 8.8 indicates high severity. Exploitation requires only network access via HTTP and low‑privileged credentials, making it potentially easily exploitable. While not currently listed in the CISA KEV catalog, the vulnerability could be leveraged by adversaries for direct takeover of affected systems.

Generated by OpenCVE AI on October 21, 2026 at 02:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch released for the affected Product Hub versions
  • If a patch is delayed, restrict HTTP access to authorized users and isolate the Product Hub from untrusted networks
  • Enforce strong authentication and enable multi‑factor authentication on the Product Hub web interface
  • Monitor authentication logs for abnormal activity and enforce account lockout or other defensive measures

Generated by OpenCVE AI on October 21, 2026 at 02:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Oracle Product Hub Remote Code Execution Vulnerability in HTTP Handler
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:49.052Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101854

cve-icon Vulnrichment

Updated: 2026-10-29T10:41:06.595Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:41.420

Modified: 2026-10-29T11:17:22.810

Link: CVE-2026-101854

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:00:08Z

Weaknesses