CVE-2026-83487 is a vulnerability in the Oracle Product Hub product of Oracle E-Business Suite, specifically in the Item Catalog component. It affects supported versions 12.2.3 through 12.2.15. The vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub, potentially resulting in unauthorized access to critical data or complete access to all data accessible through Oracle Product Hub. The CVSS 3.1 base score is 7.7, with attack vector network, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact but no integrity or availability impact. Oracle has released a Critical Security Patch Update in September 2026 that includes fixes for this vulnerability.

Successful exploitation can lead to unauthorized access to critical data within Oracle Product Hub, with potential scope change affecting additional Oracle products. The confidentiality of sensitive information is at high risk, though integrity and availability are not impacted. The vulnerability is exploitable remotely over the network with low complexity and low privileges required.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the relevant patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No additional mitigations are specified beyond applying the official patch.