This vulnerability affects Oracle Product Hub versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Product Hub. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm a fix for this CVE in the provided content. The vulnerability is currently published and no known exploits in the wild have been reported.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Hub, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the affected system's data. There is no indication of availability impact. The vulnerability is considered high severity with a CVSS score of 8.1.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities across its products. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for CVE-2026-47019. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until a patch is confirmed and applied, organizations should restrict network access to Oracle Product Hub instances and monitor for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.