This vulnerability affects Oracle Product Hub in Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is exploitable remotely over the network via HTTP by an attacker with low privileges and no user interaction required. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle Product Hub. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts without availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. The vendor strongly recommends applying these patches promptly.

An attacker with network access and low privileges can exploit this vulnerability to gain unauthorized access to critical data within Oracle Product Hub, including the ability to create, delete, or modify such data. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported as of the advisory date.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay to remediate the vulnerability. Oracle recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are specified in the advisory.