Executive brief
Oracle E-Business Suite's Product Hub is a core enterprise component used to manage product information across large organizations. A vulnerability in its Internal Operations module allows a high-privileged attacker with network access to take complete control of the system, potentially exposing or modifying critical product data and disrupting business operations.
Technical details
This is a privilege escalation vulnerability in the Oracle E-Business Suite Product Hub's Internal Operations component. The vulnerability is easily exploitable and requires only network access via HTTP, but requires high-level privileges as a precondition. Successful exploitation results in full system compromise including confidentiality, integrity, and availability impacts. The vulnerability affects versions 12.2.3 through 12.2.15, and patches are expected to be available through Oracle's standard security update process.
Affected products
- Oracle E-Business Suite Product Hub 12.2.3-12.2.15
Timeline
- 2026-09-15: disclosed