CVE-2026-83487 in Product Hub
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Item Catalog component of Oracle Product Hub, a critical module in the Oracle E-Business Suite ecosystem affecting versions 12.2.3 through 12.2.15. This security flaw represents a significant risk due to its potential for unauthorized access to sensitive enterprise data. The core technical issue allows an attacker with low privileges and network connectivity via HTTP to exploit the vulnerability, leading to a compromise of the Oracle Product Hub environment. Although the defect is localized within this specific product module, the architectural integration of E-Business Suite means that successful exploitation can trigger a scope change, potentially impacting additional interconnected products and expanding the blast radius beyond the initial target component.
From an operational perspective, the impact of this vulnerability is severe, primarily centered on data confidentiality. A successful exploit enables low-privileged attackers to gain unauthorized access to critical business information stored within the Item Catalog or achieve complete access to all data accessible by Oracle Product Hub. This level of access can lead to significant intellectual property theft, competitive intelligence leakage, and regulatory compliance violations depending on the nature of the exposed data. The high confidentiality impact aligns with a CVSS 3.1 Base Score of 7.7, indicating that while integrity and availability may not be directly compromised in this specific vector, the loss of sensitive information poses a substantial threat to organizational security posture.
In terms of industry standard classifications, this vulnerability is best categorized under CWE-200: Information Exposure, as it facilitates unauthorized disclosure of data. Furthermore, given the requirement for network access and low privileges without user interaction, the attack pattern corresponds closely to MITRE ATT&CK technique T1078: Valid Accounts, where attackers leverage existing but insufficiently restricted credentials or session tokens to move laterally or extract data. The use of HTTP rather than HTTPS suggests that if transport encryption is not enforced, the vulnerability could be exacerbated by man-in-the-middle attacks during exploitation, although the primary flaw lies in the application-level access control logic within the Item Catalog component itself.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle E-Business Suite and Product Hub as provided by Oracle Security Alerts. Organizations should also implement strict network segmentation to limit HTTP access to these components from untrusted networks, ensuring that only authorized internal subnets can reach the application servers. Additionally, enforcing HTTPS with strong cipher suites is essential to protect data in transit and reduce the risk of credential interception during authentication processes. Regular audits of user privileges within Oracle Product Hub are recommended to ensure that low-privileged accounts do not possess excessive permissions related to item catalog operations, thereby reducing the attack surface available to potential intruders who have already gained a foothold through other means.