CVE-2026-87156

CVE-2026-87156 is a vulnerability in the Internal Operations component of Oracle Product Hub within Oracle E-Business Suite, affecting releases 12.2.3 through 12.2.15. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, requiring no user interaction. A successful attack can expose critical data or grant complete read access to all Oracle Product Hub data, as well as unauthorized update, insert, and delete access to some of that data. Organizations running affected E-Business Suite 12.2 releases with Product Hub are at risk, particularly where end users have accounts with minimal privileges. The flaw carries a CVSS 3.1 base score of 7.1; no public proof of concept or known in-the-wild exploitation has been reported, and it is not on the CISA KEV list.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-87156 to all E-Business Suite 12.2 environments running Product Hub. Review which low-privilege EBS accounts can reach Product Hub Internal Operations functions over HTTP and restrict or revoke unnecessary access; consider blocking internet exposure of EBS self-service/internal URLs. Audit Product Hub data access logs for unexpected reads or data modifications by low-privilege accounts to rule out prior compromise.