A vulnerability in Oracle Product Hub permits a low‑privileged attacker with network access to HTTP to create, delete, or modify critical data and access all data available through the hub. The flaw enables unauthorized access to sensitive information and full control over product data, causing confidentiality and integrity violations. The impact is limited to data manipulation but is sufficient to compromise the integrity of the entire product hub environment.

The affected product is Oracle Product Hub, part of Oracle E‑Business Suite, supported versions 12.2.3 through 12.2.15. Users running any of these releases are at risk if the product hub is exposed to HTTP traffic.

The CVSS base score of 6.8 indicates a moderate severity. The EPSS score is less than 1 %, implying a low probability of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based exploitation over HTTP, requiring only low privileges, making it a plausible threat in environments where the hub is reachable from untrusted networks. The configuration permissions for accessing the hub should be tightened to mitigate exploitation.