This vulnerability in Oracle Product Hub (component: Item Catalog) allows an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized access to critical or all accessible data within Oracle Product Hub. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact without affecting integrity or availability. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Product Hub. The vulnerability impacts confidentiality significantly but does not affect integrity or availability. The scope change means that other Oracle products may also be impacted indirectly by attacks exploiting this vulnerability.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the provided patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.