CVE-2026-83487
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Vulnerability in Oracle Product Hub within Oracle E-Business Suite (component: Item Catalog) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data, and the attack may impact additional products (scope change).
Risk Assessment
An attacker could gain access to critical data in the product catalog, potentially breaching information confidentiality. Scope change means effects may also impact other systems.
Recommendation
Update Oracle E-Business Suite to the latest patched version. Restrict network access to the system and monitor for unusual user activity.
Other vulnerabilities in Oracle Product Hub
See all- CVE-2026-87156High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify some data via HTTP.
- CVE-2026-87155High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.
- CVE-2026-87154High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can create, delete, or modify critical data and gain full access via HTTP.
- CVE-2026-87153High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can create, delete, or modify critical data and gain full access via HTTP.
- CVE-2026-83486High
Vulnerability in Oracle Product Hub (component: Item Catalog) of Oracle E-Business Suite. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in Oracle Product Hub.
- CVE-2026-83485High
Vulnerability in Oracle Product Hub (component: Item Catalog) of Oracle E-Business Suite. Affects versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data or all data accessible in Oracle Product Hub.
- CVE-2026-83444High
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise the product.
- CVE-2026-83442High
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows a high privileged attacker with network access via HTTP to compromise the product.
- CVE-2026-83441Medium
Vulnerability in Oracle E-Business Suite Oracle Product Hub product (component: Internal Operations) affects versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify data.
- CVE-2026-83440High
Vulnerability in Oracle Product Hub of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can compromise Oracle Product Hub. Easily exploitable, CVSS 7.2.
Original NVD description (English source)
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. While the vulnerability is in Oracle Product Hub, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS