This vulnerability affects Oracle Product Hub component Internal Operations in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It enables a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical or all accessible data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact. The vendor advisory is a general Critical Patch Update for July 2026 but does not explicitly state patch availability or remediation details for this specific vulnerability. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Product Hub, compromising confidentiality and integrity of sensitive information. There is no impact on availability. This could result in significant data integrity and confidentiality breaches within affected Oracle Product Hub environments.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Product Hub HTTP interfaces to trusted users only and monitor for suspicious activity consistent with unauthorized data manipulation attempts.