Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Published: 2026-10-20
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Access to Critical Data
Action: Apply Patch
AI Analysis

Impact

A vulnerability in Oracle Product Hub allows a low‑privileged attacker with network access over HTTP to compromise the component. The flaw can be exploited to obtain unauthorized access to critical data stored within the Product Hub; the impact is primarily on confidentiality, with no direct integrity or availability effects stated.

Affected Systems

Oracle Corporation’s Product Hub enterprise application, versions 12.2.3 through 12.2.15 of Oracle E‑Business Suite, is affected. No additional vendor or product details are supplied beyond the Oracle Product Hub component of Internal Operations.

Risk and Exploitability

The CVSS 3.1 base score is 6.5, indicating a moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the internet or an internal network via HTTP, and the attacker only needs low privileges to attempt exploitation.

Generated by OpenCVE AI on October 27, 2026 at 15:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Product Hub patch or update to a version newer than 12.2.15 as detailed in the Oracle CPU Oct 2026 security alert
  • Restrict HTTP access to the Product Hub to a whitelist of trusted IP addresses or internal network segments
  • Enable detailed logging for HTTP requests to the Product Hub component and monitor for anomalous activity

Generated by OpenCVE AI on October 27, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Remote Access Compromise in Oracle Product Hub
Weaknesses CWE-284

Tue, 27 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Remote Access Compromise in Oracle Product Hub
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T11:58:02.904Z

Reserved: 2026-09-28T15:40:09.511Z

Link: CVE-2026-101855

cve-icon Vulnrichment

Updated: 2026-10-27T11:57:55.996Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:18:41.533

Modified: 2026-10-27T12:17:01.317

Link: CVE-2026-101855

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T15:30:05Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor