CVE-2026-61311
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Oracle Product Hub (Oracle E-Business Suite) component Internal Operations. Versions 12.2.3-12.2.15 are affected. A low-privileged attacker with network access via HTTP can compromise Oracle Product Hub.
Risk Assessment
Successful attack can lead to full takeover of Oracle Product Hub, resulting in loss of confidentiality, integrity, and availability.
Recommendation
Apply the patch provided by Oracle for Oracle E-Business Suite in the appropriate version.
Other vulnerabilities in Oracle Product Hub
See all- CVE-2026-70918High
Vulnerability in Oracle Product Hub product of Oracle E-Business Suite (component: Outbound Data). Affects versions 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub, resulting in takeover.
- CVE-2026-47019High
Vulnerability in Oracle Product Hub (Item Catalog component) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to all data and the ability to create, delete, or modify it.
Original NVD description (English source)
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).