---
id: "CVE-2026-101852"
kind: "vulnerability"
aliases: ["CVE-2026-101852"]
title: "Oracle E-Business Suite Product Hub: low-privilege web user can take over"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite Product Hub", "fixed": ["October 2026 CPU"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-ebs", "oracle-product-hub", "other", "package", "self-hosted"]
not_affected_if: ["auth-required", "cpu-oct-2026-applied", "no-product-hub"]
published_at: "2026-10-20T22:18:41+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-24T00:05:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101852", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:05:19+00:00"}]
---

# Oracle E-Business Suite Product Hub: low-privilege web user can take over

Oracle E-Business Suite Product Hub (component: Internal Operations), 12.2.3-12.2.15, has an easily exploitable flaw over HTTP. A low-privileged authenticated user can take over Product Hub (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N, C/I/A high). Fixed by Oracle's October 2026 Critical Patch Update. No exploitation or public PoC known.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Product Hub affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU

## How to check

Run the EBS Critical Patch Update Checker (ECPUC, Patch 35583866) and read ECPUC.lst: it shows your current CPU/CSPU level and the required October 2026 patches. You are affected if you run EBS 12.2.3-12.2.15 with Product Hub and have not applied the October 2026 CPU. Exact patch number: see MOS KA923.

## Fix

Apply the Oracle E-Business Suite October 2026 CPU (released 20 Oct 2026) via the patch list in MOS Article KA923. The exact Product Hub patch for this CVE is unconfirmed (needs MOS access). Until then, restrict network access to EBS web endpoints and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101852
- 2026-10-24T00:05:19+00:00 analyst — Oracle October 2026 CPU (20 Oct) lists EBS 12.2.3-12.2.15 as affected; exact Product Hub patch number for this CVE not readable without MOS login (KA923 points to the current CPU/CSPU doc). Armis claims 'unauthenticated' and 'fixed in 12.2.16'; contradicts Oracle (PR:L) and unsupported by Oracle pages I read, so ignored. Rapid7 gives Patch 40022426 only for sibling CVE-2026-83393, not confirmed for this one. No exploitation or PoC found, no X conversation (count 0).

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Critical Patch Update for October 2026 Now Available (EBS) https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available
- [mentions] Rapid7: CVE-2026-101852 https://www.rapid7.com/db/vulnerabilities/cve-2026-101852/
- [mitigation] October 2026 Updates to EBS Critical Patch Update Checker (ECPUC) https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc

## From the sources

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_