CVE-2026-87155 in Product Hub
Summary
by MITRE • 09/16/2026
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Internal Operations component of Oracle Product Hub, a critical module in the Oracle E-Business Suite ecosystem designed to manage product information and lifecycle data. This security flaw affects supported versions ranging from 12.2.3 through 12.2.15, representing a significant portion of active deployments across various industries that rely on these enterprise resource planning systems for core operational functions. The nature of this vulnerability is particularly concerning because it allows an attacker with low privileges and network access via the HTTP protocol to execute unauthorized actions against the system. Unlike high-privilege exploits that require deep administrative access, this flaw can be leveraged by users who have been granted basic or standard user roles within the application, thereby expanding the potential attack surface significantly among internal staff or compromised accounts.
From a technical perspective, the vulnerability enables an attacker to compromise the integrity and confidentiality of the Oracle Product Hub environment through network-based interactions. The ease of exploitation suggests that the flaw likely involves improper access control checks or input validation mechanisms within the HTTP request handling logic of the Internal Operations module. When triggered, this defect allows the malicious actor to bypass intended security boundaries, leading to a complete takeover of the affected instance. This level of compromise implies that the attacker gains the ability to modify system configurations, alter product data, and potentially execute arbitrary code or commands with elevated privileges equivalent to those of the application server itself. The operational impact is severe, as it directly affects confidentiality by exposing sensitive business data, integrity by allowing unauthorized modifications to critical product records, and availability by potentially disrupting service through malicious state changes or resource exhaustion.
The severity of this issue is quantified by a CVSS 3.1 Base Score of 8.8, classified as High Severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack vector is Network-based with Low complexity and requires no user interaction, while only needing Low privileges to initiate. The scope remains Unchanged, meaning the impact is confined to the vulnerable component but results in High impacts across all three security pillars. In terms of industry standard classifications, this vulnerability aligns closely with CWE-269 Improper Privilege Management or CWE-862 Missing Authorization, as it allows a lower-privileged user to perform actions that should be restricted. Furthermore, from the perspective of the MITRE ATT&CK framework, this exploit likely corresponds to techniques involving Account Manipulation or Defense Evasion, allowing an adversary to establish persistence and move laterally within the enterprise network after initial compromise.
To mitigate this risk, organizations running affected versions must immediately apply the latest security patches provided by Oracle for their specific release branch of Oracle E-Business Suite. It is imperative that system administrators verify which modules are enabled in their environment, as the vulnerability specifically targets Internal Operations functionality. In addition to patching, implementing strict network segmentation can help limit exposure; ensuring that HTTP access to these internal components is restricted to trusted IP ranges and authenticated management networks reduces the likelihood of remote exploitation. Furthermore, organizations should review user privilege assignments within Oracle Product Hub to ensure adherence to the principle of least privilege, minimizing the number of users with low-level but potentially exploitable accounts. Regular vulnerability scanning and monitoring for anomalous HTTP requests targeting internal APIs can also provide early detection indicators before a full compromise occurs.