Executive brief
Oracle Product Hub is an internal operations component of Oracle E-Business Suite used to manage business data and processes. A vulnerability in this component allows a low-privileged user with network access to gain complete control over the Product Hub system, potentially exposing or modifying sensitive business data and disrupting critical operations.
Technical details
This vulnerability in Oracle E-Business Suite's Product Hub component (Internal Operations module) is easily exploitable and allows a low-privileged attacker with network access via HTTP to achieve complete compromise. The attack requires only low privileges and network connectivity, with no user interaction needed. Successful exploitation results in full takeover of the Product Hub, leading to confidentiality, integrity, and availability impacts. Affected versions are 12.2.3 through 12.2.15. Patch availability should be verified through Oracle's official security advisories.
Affected products
- Oracle E-Business Suite 12.2.3 through 12.2.15
Timeline
- 2026-09-15: disclosed