CVE-2026-61274 in Product Hub
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Product Hub accessible data as well as unauthorized read access to a subset of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Product Hub, a critical component of the Oracle E-Business Suite ecosystem that manages product catalog data and item information. The affected version range spans from 12.2.3 through 12.2.15, indicating a substantial attack surface across multiple releases of this enterprise resource planning module. The vulnerability is classified as easily exploitable, meaning that attackers with minimal technical expertise can leverage it effectively. The attack vector requires only network access via HTTP, making it particularly dangerous as it can be exploited from remote locations without requiring physical presence or complex authentication mechanisms.
The technical flaw manifests as a privilege escalation issue within the Item Catalog component where low-privileged users can potentially gain unauthorized access to critical system functions. This vulnerability allows attackers to perform unauthorized update, insert, and delete operations against specific Oracle Product Hub data sets, while simultaneously enabling unauthorized read access to sensitive subset data. The partial denial of service aspect suggests that attackers could disrupt system availability for certain functionalities without completely taking down the entire application. This type of vulnerability typically stems from inadequate input validation or insufficient access controls within the web application layer.
The security implications extend across all three pillars of the CIA triad with a CVSS base score of 6.3 indicating moderate severity. The confidentiality impact is rated as low, suggesting that sensitive data exposure is limited to specific subsets rather than comprehensive database breaches. However, the integrity and availability impacts are also rated as low, meaning that attackers can modify data and potentially disrupt service operations within the Product Hub module. This vulnerability aligns with CWE-284 (Improper Access Control) and may also relate to CWE-79 (Cross-site Scripting) if the application fails to properly sanitize user inputs. The attack pattern follows ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing) as attackers would likely need to obtain legitimate credentials before exploiting this access control weakness.
Organizations should prioritize immediate patch management to address this vulnerability, particularly given the supported version range that includes multiple releases of Oracle E-Business Suite. Network segmentation strategies should be implemented to limit exposure of the Product Hub module to untrusted networks, while robust monitoring systems should track unauthorized access attempts and data modification activities. The implementation of additional authentication layers such as multi-factor authentication for administrative functions can significantly reduce risk. Regular security assessments should verify that access controls are properly enforced across all Product Hub components, with particular attention to user permissions and session management mechanisms. Organizations should also consider implementing web application firewalls to detect and block malicious HTTP requests targeting known vulnerability patterns.