This vulnerability affects Oracle Product Hub component of Oracle E-Business Suite in versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the Oracle Product Hub, potentially resulting in full takeover. The vulnerability has a CVSS 3.1 base score of 8.5 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches from Critical Patch Updates without delay.

Successful exploitation can lead to complete compromise of Oracle Product Hub, impacting confidentiality, integrity, and availability of the system. The vulnerability’s scope change means that additional Oracle products integrated or dependent on Product Hub may also be affected. The attack requires network access via HTTP and is difficult to exploit due to high attack complexity, but only low privileges are needed. No known exploits in the wild have been reported so far.

Oracle’s July 2026 Critical Patch Update advisory includes security patches addressing this and other vulnerabilities. Customers should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Since no explicit patch or remediation level is stated for this vulnerability alone, applying the full Critical Patch Update is the recommended mitigation. Oracle also advises remaining on actively supported versions and applying security patches without delay to prevent exploitation.