This vulnerability affects Oracle Product Hub within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It permits an attacker with low privileges and network access over HTTP to compromise the product, leading to potential full system takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches across Oracle products, but the advisory does not explicitly state the patch status or remediation level for this vulnerability. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation can lead to complete compromise of Oracle Product Hub, affecting confidentiality, integrity, and availability of the system. This could allow attackers to take over the product, potentially impacting business operations relying on Oracle Product Hub.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm patch availability or provide specific remediation instructions for this vulnerability. Customers are strongly advised to review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches promptly. Maintaining up-to-date software and applying Oracle's security patches without delay is the recommended mitigation approach.