This vulnerability affects Oracle Product Hub, a component of Oracle E-Business Suite, in versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Product Hub. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts with no impact on availability. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 other security patches. Oracle strongly recommends applying these patches promptly to mitigate exploitation risks.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Hub, or unauthorized access to all data accessible through the product. This compromises the confidentiality and integrity of sensitive information managed by Oracle Product Hub. There is no reported impact on system availability.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) should apply the relevant patches without delay. Oracle strongly advises remaining on actively supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or workarounds are specified in the vendor advisory.