Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Exploit Leading to Full Compromise
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in Oracle Product Hub, part of Oracle E‑Business Suite, allows an attacker who already possesses high‑privileged access to compromise the product. When exploited, the flaw results in a complete system takeover, compromising confidentiality, integrity, and availability as reflected by a CVSS v3.1 base score of 7.2.

Affected Systems

Oracle Product Hub within Oracle E‑Business Suite, specifically the Internal Operations component. Versions affected are 12.2.3 through 12.2.15.

Risk and Exploitability

The CVSS score indicates a moderate‑to‑high severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation would occur over the network via the HTTP interface, requires no user interaction, and demands high‑privilege accounts, indicating that a successful attacker could control the Product Hub fully.

Generated by OpenCVE AI on September 20, 2026 at 07:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Product Hub patch or upgrade to a version newer than 12.2.15
  • Restrict HTTP access to the Product Hub by limiting the use of high‑privileged accounts and enforcing least‑privilege policies to reduce the risk of exploitation
  • Monitor application and web server logs for suspicious HTTP activity indicative of an attempted exploitation

Generated by OpenCVE AI on September 20, 2026 at 07:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Title High‑Privilege Exploitation of Oracle Product Hub Over HTTP

Fri, 18 Sep 2026 15:00:00 +0000

Type Values Removed Values Added
Title High-Privilege HTTP Exploit of Oracle Product Hub Leading to Full Compromise
Weaknesses CWE-284
CWE-285

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Title High-Privilege HTTP Exploit of Oracle Product Hub Leading to Full Compromise
Weaknesses CWE-284
CWE-285

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:24.641Z

Reserved: 2026-08-31T15:40:57.359Z

Link: CVE-2026-83440

cve-icon Vulnrichment

Updated: 2026-09-17T12:58:54.519Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:18:52.637

Modified: 2026-09-22T19:06:41.333

Link: CVE-2026-83440

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T07:30:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management