This vulnerability affects Oracle Product Hub versions 12.2.3 through 12.2.15 and involves the Role Based Security component. An attacker with low privileges and network access via HTTP can exploit this flaw to gain unauthorized capabilities including reading, updating, inserting, or deleting some accessible data within Oracle Product Hub. Additionally, the attacker can cause a partial denial of service. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. No vendor advisory explicitly states a patch or fix for this specific vulnerability yet, but Oracle's July 2026 Critical Patch Update advisory should be monitored for updates.

Successful exploitation results in unauthorized read access to some data, unauthorized modification (update, insert, delete) of some data, and the ability to cause a partial denial of service in Oracle Product Hub. This compromises confidentiality, integrity, and availability to a limited extent as indicated by the CVSS score of 6.3.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Product Hub and monitor for unusual activity consistent with unauthorized data access or service disruption.