This vulnerability affects Oracle Product Hub, a component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible through Oracle Product Hub. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 security patches across multiple products.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Product Hub or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive business data managed by Oracle Product Hub. Availability is not impacted according to the CVSS vector. The vulnerability is exploitable remotely over the network with low complexity and minimal privileges, increasing the risk of compromise if unpatched.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Product Hub versions 12.2.3 through 12.2.15 without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.