CVE-2026-87155

CVE-2026-87155 is a high-severity (CVSS 8.8) vulnerability in the Internal Operations component of Oracle Product Hub, part of Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged attacker who has network access to the EBS environment via HTTP and a valid low-level account. A successful attack allows the attacker to fully compromise Oracle Product Hub, with high impact on confidentiality, integrity, and availability — effectively a takeover of the product. Organizations running affected EBS 12.2 releases with the Product Hub module are at risk, particularly where self-service or external-facing HTTP endpoints are reachable. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation is not currently observed in the wild.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-87155 to all EBS 12.2.3-12.2.15 environments running Product Hub. Restrict HTTP access to EBS so the Product Hub/Internal Operations endpoints are not reachable from untrusted networks, and enforce least-privilege on low-privileged application accounts. Review audit logs for anomalous activity by low-privilege users against Product Hub, such as unexpected privilege escalation or data access, that could indicate an attempted compromise.