CVE-2026-61275 in Product Hub
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Role Based Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Product Hub accessible data as well as unauthorized read access to a subset of Oracle Product Hub accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Product Hub. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Product Hub, a critical component of the Oracle E-Business Suite ecosystem that manages product information and data integration across enterprise environments. The flaw specifically affects the Role Based Security implementation within this module, which governs user access permissions and data visibility controls. The affected versions span from 12.2.3 through 12.2.15, indicating a prolonged period of exposure where organizations utilizing these Oracle EBS releases remained susceptible to potential exploitation. The vulnerability's classification as easily exploitable suggests that attackers with minimal technical expertise and network access can leverage this weakness, making it particularly dangerous in production environments where security controls may be insufficient.
The technical nature of this vulnerability stems from inadequate authorization checks within the Role Based Security framework, allowing an attacker with low privileges to bypass normal access controls. This weakness manifests through HTTP network connections, meaning that malicious actors can exploit the vulnerability remotely without requiring physical access to the system or elevated credentials. The security implications extend beyond simple data access violations to encompass comprehensive data manipulation capabilities including unauthorized updates, inserts, and deletes of product information within the Oracle Product Hub. Additionally, attackers can achieve unauthorized read access to sensitive subsets of data, potentially exposing confidential business information, product specifications, pricing details, or supplier configurations that should remain restricted to authorized personnel.
The operational impact of this vulnerability creates a multi-faceted threat landscape affecting all three core security principles defined by the CVSS 3.1 framework. Confidentiality is compromised as attackers can access restricted product data, potentially exposing trade secrets, competitive information, or sensitive supplier details. Integrity suffers through unauthorized modification capabilities that could corrupt product catalogs, alter pricing structures, or manipulate critical business data leading to financial losses and operational disruption. Availability is impacted through partial denial of service conditions that may limit legitimate users' ability to access essential product information systems during peak business hours. The CVSS base score of 6.3 reflects a medium severity classification indicating substantial risk without reaching critical levels, yet the combination of confidentiality, integrity, and availability impacts creates significant business disruption potential.
Organizations must implement immediate mitigations including applying the relevant Oracle critical patch updates that address this specific authorization bypass vulnerability. Network segmentation should be enhanced to limit direct HTTP access to Oracle Product Hub components while implementing robust firewall rules and access controls. The principle of least privilege must be enforced more rigorously, ensuring that user accounts have minimal necessary permissions and that role-based access controls are properly configured and regularly audited. Security monitoring should be strengthened to detect anomalous access patterns or unauthorized data modifications that may indicate exploitation attempts. This vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK techniques involving privilege escalation and data manipulation, emphasizing the need for comprehensive security controls beyond simple patch management approaches. Regular security assessments and penetration testing should be conducted to validate the effectiveness of implemented controls and identify potential additional weaknesses in the Oracle EBS environment that could be exploited by adversaries seeking to leverage similar authorization bypass vulnerabilities.