CVE-2026-83485

CVE-2026-83485 is an information-disclosure flaw in the Item Catalog component of Oracle Product Hub, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP — for example, any authenticated EBS user with minimal privileges — can easily exploit the flaw to gain unauthorized access to critical data or complete access to all data reachable through Oracle Product Hub. Because of a scope change, successful attacks may also significantly impact additional Oracle E-Business Suite products beyond Product Hub itself. The vulnerability carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), with high confidentiality impact but no integrity or availability impact. There is no known public proof of concept and the flaw is not on the CISA KEV list, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83485 to all E-Business Suite 12.2.3-12.2.15 environments running Product Hub, prioritizing instances with HTTP endpoints reachable from untrusted networks. Restrict access to EBS self-service and Product Hub pages so only necessary authenticated users can reach the Item Catalog functionality, and enforce least-privilege roles for low-privileged accounts. Review audit logs for unusual data retrieval by low-privilege users against Product Hub and related modules to rule out prior exploitation.