CVE-2026-83441 is a vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations) affecting supported versions 12.2.3 through 12.2.15. The vulnerability is difficult to exploit and requires a low privileged attacker with network access via HTTP. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Product Hub. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N with a base score of 6.8.

An attacker with low privileges and network access could exploit this vulnerability to gain unauthorized access to critical data within Oracle Product Hub, including the ability to create, delete, or modify data. This compromises confidentiality and integrity of the data but does not affect availability. There are no known exploits in the wild at this time.

Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.3 through 12.2.15 of Oracle E-Business Suite. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed as available via the official Oracle advisory.