This vulnerability in Oracle Product Hub (component: Item Catalog) allows an attacker with low privileges and network access via HTTP to compromise the product. The scope of impact may extend to additional Oracle products due to shared components or integration. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through Oracle Product Hub. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. Oracle's advisory confirms the vulnerability is addressed in the September 2026 Critical Security Patch Update, which contains targeted fixes for this and many other vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized access to sensitive or critical data within Oracle Product Hub, potentially compromising confidentiality. There is no reported impact on data integrity or availability. The vulnerability's scope change suggests that other Oracle products integrated with or dependent on Oracle Product Hub might also be affected indirectly.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers using Oracle Product Hub versions 12.2.3 through 12.2.15 should apply the relevant patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No additional mitigations are specified beyond patching.