Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Takeover of Oracle Product Hub
Action: Immediate Patch
AI Analysis

Impact

Vulnerability in Oracle Product Hub (component Internal Operations) allows a low‑privileged attacker with network access to compromise the service. The flaw is difficult to exploit but results in full takeover, compromising confidentiality, integrity, and availability.

Affected Systems

Oracle Product Hub in Oracle E‑Business Suite. Versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

CVSS v3.1 base score of 8.5 indicates high severity. The EPSS score is less than 1%, indicating a low probability that the vulnerability has been exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker who is a low‑privileged user on the network can trigger the flaw via HTTP, leading to a takeover of Oracle Product Hub and potentially other products due to a scope change. Because of the low EPSS and lack of public exploit data, the likelihood of exploitation is uncertain, but the high CVSS and scope change mean that successful exploitation would cause significant impact on confidentiality, integrity, and availability.

Generated by OpenCVE AI on October 29, 2026 at 12:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle E‑Business Suite security patch that addresses CVE-2026-83393 as detailed in the Oracle CPU Oct 2026 advisory.
  • Restrict network access to Oracle Product Hub by limiting HTTP connections to trusted internal IP ranges or enforcing VPN access.
  • Enable comprehensive logging and alerting for authentication failures and anomalous requests to the Product Hub service.

Generated by OpenCVE AI on October 29, 2026 at 12:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Title Remote Takeover of Oracle Product Hub via HTTP Exploit
Weaknesses CWE-269
CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T10:45:48.626Z

Reserved: 2026-08-31T15:40:57.356Z

Link: CVE-2026-83393

cve-icon Vulnrichment

Updated: 2026-10-29T10:40:57.583Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:19:55.743

Modified: 2026-10-29T11:17:35.160

Link: CVE-2026-83393

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T13:00:22Z

Weaknesses