This vulnerability affects Oracle Product Hub within Oracle E-Business Suite, specifically versions 12.2.3 to 12.2.15. It enables an attacker with low privileges and network access via HTTP to compromise the product, resulting in unauthorized access to critical data and partial unauthorized modification capabilities. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes including this issue.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Product Hub. Additionally, attackers may gain unauthorized update, insert, or delete privileges on some data. This compromises confidentiality and integrity of the affected system's data, potentially leading to data breaches or unauthorized data manipulation.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Users of Oracle Product Hub versions 12.2.3 through 12.2.15 are strongly advised to apply the available patches promptly to remediate this vulnerability. Oracle recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.