This vulnerability in Oracle Product Hub versions 12.2.3 to 12.2.15 allows an attacker with low privileges and network access over HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impacts without availability impact. The vendor advisory does not explicitly confirm a patch availability for this specific vulnerability but references the July 2026 Critical Patch Update, which includes numerous security patches. Oracle advises customers to remain on supported versions and apply patches without delay to mitigate such vulnerabilities.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Hub, compromising data confidentiality and integrity. This could affect all data accessible through Oracle Product Hub, potentially leading to significant business impact due to data manipulation or loss of data trustworthiness. There is no reported impact on availability. No known exploits are currently reported in the wild.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches promptly to supported versions. Although no explicit patch or remediation level is stated for this vulnerability, customers should review the July 2026 CPU documentation and apply all relevant patches for Oracle Product Hub versions 12.2.3 through 12.2.15. Maintaining up-to-date patching is the primary mitigation. No vendor advisory states that no action is required or that the issue is already mitigated.