Description
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote compromise of Oracle Product Hub
Action: Immediate Patch
AI Analysis

Impact

This vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Product Hub. The flaw permits the attacker to bypass authentication boundaries, resulting in complete loss of confidentiality, integrity, and availability of the product hub. The CVSS v3.1 base score is AV:N, AC:L, PR:L, UI:N, S:U, C:H, I:H, A:H. Oracle Product Hub is part of Oracle E‑Business Suite.

Affected Systems

Oracle Corporation's Oracle Product Hub, versions 12.2.3 through 12.2.15.

Risk and Exploitability

The vulnerability carries a high CVSS 8.8 score and is network host that can reach the HTTP endpoint of the product hub. EPSS score is reported as <1%, indicating a very low exploitation probability, and the flaw is not listed in CISA KEV. An attacker who succeeds can take over the product hub, compromising its confidentiality, integrity, and availability for the hosting environment.

Generated by OpenCVE AI on September 17, 2026 at 23:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Product Hub patch or upgrade to a non‑affected version (e.g., 12.2.16 or newer).
  • Restrict HTTP access to Oracle Product Hub to only trusted internal hosts or enforce network segmentation.
  • Disable or reconfigure any unnecessary HTTP services that expose the product hub to the network.

Generated by OpenCVE AI on September 17, 2026 at 23:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Oracle Product Hub Credential Bypass Leading to Full Compromise
Weaknesses CWE-287

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 18:15:00 +0000

Type Values Removed Values Added
Title Oracle Product Hub Credential Bypass Leading to Full Compromise
Weaknesses CWE-287

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle product Hub
CPEs cpe:2.3:a:oracle:product_hub:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle product Hub
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Product Hub
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:21.627Z

Reserved: 2026-09-08T21:49:12.398Z

Link: CVE-2026-87155

cve-icon Vulnrichment

Updated: 2026-09-17T12:57:46.909Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:19:02.990

Modified: 2026-09-22T19:03:31.023

Link: CVE-2026-87155

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T23:45:17Z

Weaknesses
  • CWE-269

    Improper Privilege Management