This vulnerability affects Oracle Product Hub component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges but requires high attack complexity. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by Oracle Product Hub. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. There are no known exploits in the wild. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Product Hub. This compromises confidentiality and integrity of the affected system's data. There is no impact on availability. The vulnerability requires network access and a low privileged attacker but is difficult to exploit due to high attack complexity.

Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant security patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed available via the Oracle advisory. No alternative mitigations are specified by the vendor.