{"id":"CVE-2026-101853","kind":"vulnerability","aliases":["CVE-2026-101853"],"related":[],"title":"Oracle E-Business Suite Product Hub: low-privilege takeover over HTTP","description":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Product Hub in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can take over the application, with full confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Product Hub (E-Business Suite)","fixed":["October 2026 CPU"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-ebs","other","product-hub","self-hosted"],"not_affected_if":["october-2026-cpu-applied","outside-affected-versions"],"how_to_check":"Run the EBS Critical Patch Update Checker (ECPUC, Patch 35583866, latest version): ECPUC.sql writes ECPUC.lst showing your current CPU/CSPU level and the missing October 2026 patches. Exposed if you run Product Hub on EBS 12.2.3-12.2.15 without the October 2026 CPU.","fix":"Apply the Oracle E-Business Suite October 2026 CPU/CSPU patches for release 12.2 (find the current patch list via MOS Article KA923). No standalone workaround documented. Restrict network access to the EBS application tier as a stopgap.","status":"open","published_at":"2026-10-20T22:18:41+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:34+00:00","updated_at":"2026-10-24T00:05:04+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:38:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle E-Business Suite Product Hub: low-privilege takeover over HTTP","impact":"high","summary":"Oracle Product Hub in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can take over the application, with full confidentiality, integrity and availability impact.","category":"other","who_cares":["oracle-ebs","product-hub"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over Product Hub, reading and changing all its data","analyst_note":"Find the Oracle Security Alert advisory and patch for E-Business Suite 12.2.3-12.2.15 to confirm the fixed patch level and any check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["outside-affected-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000485,"input_tokens":3057,"output_tokens":358,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Security Alert advisory and patch for E-Business Suite 12.2.3-12.2.15 to confirm the fixed patch level and any check steps.","search":"'-101853':16A,19A '-2026':15A,18A '/av':146C '12.2.15':47B,101C '12.2.3':45B,100C '3.1':133C,145C '8.8':136C 'access':63B,111C 'affect':98C 'allow':105C 'applic':70B 'attack':108C,120C 'avail':76B,140C 'base':134C 'busi':4A,43B,89C 'business':25A 'compon':55B,91C 'compromis':115C 'confidenti':73B,137C 'cve':14A,17A 'cvss':132C,142C,144C 'e':3A,24A,42B,88C 'e-busi':2A,41B,87C 'e-business':23A 'easili':102C 'eb':29B 'exploit':103C 'flaw':50B 'full':72B 'h':154C 'h/a':153C 'h/i':152C 'host':36B 'http':13A,65B,113C 'hub':7A,22A,33B,39B,83C,118C,131C 'impact':77B,141C 'integr':74B,138C 'intern':53B,92C 'l/pr':148C 'l/ui':149C 'low':9A,58B,106C 'low-privileg':8A,57B 'n/ac':147C 'n/s':150C 'network':62B,110C 'oper':54B,93C 'oracl':1A,28B,37B,81C,86C,116C,129C 'oracle':20A 'oracle-eb':27B 'privileg':10A,59B,107C 'product':6A,21A,32B,38B,82C,84C,117C,130C 'product-hub':31B 'result':125C 'score':135C 'self':35B 'self-host':34B 'success':119C 'suit':5A,44B,90C 'suite':26A 'support':94C 'take':67B 'takeov':11A,127C 'u/c':151C 'user':60B 'vector':143C 'version':95C 'via':112C 'vulner':78C,104C,123C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101853","severity":null,"published_at":"2026-10-20T22:18:41+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101853:581","url":null,"severity":null,"published_at":"2026-10-24T00:05:04+00:00","modified_at":"2026-10-24T00:05:04+00:00","first_seen_at":"2026-10-24T00:05:04+00:00","fetched_at":"2026-10-24T00:05:04+00:00","note":"Fixed by Oracle October 2026 CPU (cpuoct2026, 20 Oct 2026); EBS-specific patch number for this CVE not read on a primary page (Rapid7 cites 40022426 for sibling CVE-2026-83393 only). No exploitation or PoC found. Armis claim of 'fixed in 12.2.16' for sibling not from Oracle; not used."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2336,"url":"https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc","title":"October 2026 Updates to EBS Critical Patch Update Checker (ECPUC)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":2337,"url":"https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available","title":"Critical Patch Update for October 2026 Now Available (EBS)","kind":"vendor","source":"analyst","text":"EBS CSPU/CPU for October 2026 released 20 Oct 2026. Oracle strongly recommends applying without delay. Latest EBS CPU doc is found via MOS KA923.","published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}