CVE-2026-87154

An easily exploitable authorization flaw in the Internal Operations component of Oracle Product Hub, part of Oracle E-Business Suite, allows a low-privileged attacker with network access via HTTP to compromise the product. Successful exploitation gives the attacker unauthorized creation, deletion, or modification of critical data, or complete read access to all Oracle Product Hub accessible data — high impact on both confidentiality and integrity (CVSS 3.1 base score 8.1), though availability is not affected. Supported E-Business Suite releases 12.2.3 through 12.2.15 are affected. No public proof of concept is known and the issue is not on the CISA Known Exploited Vulnerabilities catalog, so there is no evidence of exploitation in the wild at this time.

What to do: Apply the Oracle Critical Patch Update containing the fix for CVE-2026-87154 to every EBS 12.2.3-12.2.15 environment running Product Hub. Restrict HTTP access to EBS internal operations endpoints (VPN or IP allowlisting) and audit low-privileged application accounts for unexpected Product Hub activity, including unauthorized data creation, deletion, or modification.