{"id":"CVE-2026-101816","kind":"vulnerability","aliases":["CVE-2026-101816"],"related":[],"title":"Oracle E-Business Suite: Product Hub flaw lets high-privileged users take over","description":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Product Hub inside E-Business Suite has a flaw in its Internal Operations component that lets an attacker with high privileges reach it over HTTP. A successful attack can take over the Product Hub application, affecting confidentiality, integrity and availability.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","oracle-ebs","product-hub","runtime","self-hosted"],"not_affected_if":["product-hub-not-used"],"how_to_check":"- Check the installed E-Business Suite release: affected supported versions are `12.2.3` through `12.2.15`\n- Confirm whether Oracle Product Hub is in use in the environment\n- unknown for patch level details beyond the affected range","fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Product Hub (version to move to: unknown in the sources)\n- Restrict HTTP access to Product Hub to trusted internal networks as a stopgap","status":"open","published_at":"2026-10-20T22:18:37+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-25T03:29:12+00:00","updated_at":"2026-10-25T03:29:12+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:29:12Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for E-Business Suite Product Hub (version to move to: unknown in the sources)\n- Restrict HTTP access to Product Hub to trusted internal networks as a stopgap","reach":"network","title":"Oracle E-Business Suite: Product Hub flaw lets high-privileged users take over","impact":"high","summary":"Oracle Product Hub inside E-Business Suite has a flaw in its Internal Operations component that lets an attacker with high privileges reach it over HTTP. A successful attack can take over the Product Hub application, affecting confidentiality, integrity and availability.","category":"runtime","nicknames":[],"who_cares":["oracle-ebs","product-hub","self-hosted","erp"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over Product Hub, reading, changing and disrupting its data","analyst_note":"Find the Oracle CPU advisory for CVE-2026-101816 to confirm the patched version and any workaround; the sources give no fix version.","how_to_check":"- Check the installed E-Business Suite release: affected supported versions are `12.2.3` through `12.2.15`\n- Confirm whether Oracle Product Hub is in use in the environment\n- unknown for patch level details beyond the affected range","needs_analyst":true,"not_affected_if":["product-hub-not-used"],"who_is_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Oracle Product Hub module enabled. Sites without Product Hub, or on releases outside that range, can skip it. The sources do not say which Product Hub configurations are exposed beyond the high-privilege requirement.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000664,"input_tokens":3450,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101816':17A,20A '-2026':16A,19A '/av':142C '12.2.15':97C '12.2.3':96C '3.1':129C,141C '7.2':132C 'access':107C 'affect':69B,94C 'allow':101C 'applic':68B 'attack':51B,61B,104C,116C 'avail':73B,136C 'base':130C 'busi':4A,38B,85C 'compon':47B,87C 'compromis':111C 'confidenti':70B,133C 'cve':15A,18A 'cvss':128C,138C,140C 'e':3A,37B,84C 'e-busi':2A,36B,83C 'easili':98C 'eb':24B 'erp':21B 'exploit':99C 'flaw':8A,42B 'h':150C 'h/a':149C 'h/i':148C 'h/ui':145C 'high':11A,53B,102C 'high-privileg':10A 'host':31B 'http':58B,109C 'hub':7A,27B,34B,67B,79C,114C,127C 'impact':137C 'insid':35B 'integr':71B,134C 'intern':45B,88C 'l/pr':144C 'let':9A,49B 'n/ac':143C 'n/s':146C 'network':106C 'oper':46B,89C 'oracl':1A,23B,32B,77C,82C,112C,125C 'oracle-eb':22B 'privileg':12A,54B,103C 'product':6A,26B,33B,66B,78C,80C,113C,126C 'product-hub':25B 'reach':55B 'result':121C 'runtim':28B 'score':131C 'self':30B 'self-host':29B 'success':60B,115C 'suit':5A,39B,86C 'support':90C 'take':14A,63B 'takeov':123C 'u/c':147C 'user':13A 'vector':139C 'version':91C 'via':108C 'vulner':74C,100C,119C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle E-Business Suite release 12.2.3 through 12.2.15 with the Oracle Product Hub module enabled. Sites without Product Hub, or on releases outside that range, can skip it. The sources do not say which Product Hub configurations are exposed beyond the high-privilege requirement.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101816","severity":null,"published_at":"2026-10-20T22:18:37+00:00","modified_at":"2026-10-22T16:17:18+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}