CVE-2026-83487

CVE-2026-83487 is an information disclosure vulnerability in the Item Catalog component of Oracle Product Hub, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is rated easily exploitable: a low-privileged (authenticated) attacker with HTTP network access to the E-Business Suite environment can trigger the flaw without user interaction. Successful attacks result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data, and because the issue has a scope change, the confidentiality impact can extend beyond Product Hub to additional products. The vulnerability is confidentiality-only (CVSS 3.1 score 7.7; no integrity or availability impact), so attackers read sensitive data but do not modify or disrupt it. No public proof of concept is known, the CVE is not on CISA's KEV list, and no in-the-wild exploitation has been reported.

What to do: Apply the Oracle Critical Patch Update that addresses this CVE to all Oracle E-Business Suite 12.2.3-12.2.15 environments running Product Hub. Restrict HTTP/HTTPS access to EBS to trusted networks or VPN, enforce least-privilege roles for accounts that can reach the Item Catalog, and review audit logs for anomalous data-access patterns by low-privilege accounts. Verify the patch level of every EBS instance, including test and development environments that may also expose Product Hub.