---
id: "CVE-2026-101816"
kind: "vulnerability"
aliases: ["CVE-2026-101816"]
title: "Oracle E-Business Suite: Product Hub flaw lets high-privileged users take over"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["erp", "oracle-ebs", "product-hub", "runtime", "self-hosted"]
not_affected_if: ["product-hub-not-used"]
published_at: "2026-10-20T22:18:37+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-25T03:29:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101816", "first_seen_at": "2026-10-23T21:57:23+00:00"}]
---

# Oracle E-Business Suite: Product Hub flaw lets high-privileged users take over

Oracle Product Hub inside E-Business Suite has a flaw in its Internal Operations component that lets an attacker with high privileges reach it over HTTP. A successful attack can take over the Product Hub application, affecting confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed E-Business Suite release: affected supported versions are `12.2.3` through `12.2.15`
- Confirm whether Oracle Product Hub is in use in the environment
- unknown for patch level details beyond the affected range

## Fix

- Apply the Oracle Critical Patch Update fix for E-Business Suite Product Hub (version to move to: unknown in the sources)
- Restrict HTTP access to Product Hub to trusted internal networks as a stopgap

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101816

## From the sources

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_