---
id: "CVE-2026-101853"
kind: "vulnerability"
aliases: ["CVE-2026-101853"]
title: "Oracle E-Business Suite Product Hub: low-privilege takeover over HTTP"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Oracle Product Hub (E-Business Suite)", "fixed": ["October 2026 CPU"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-ebs", "other", "product-hub", "self-hosted"]
not_affected_if: ["october-2026-cpu-applied", "outside-affected-versions"]
published_at: "2026-10-20T22:18:41+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-24T00:05:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101853", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:05:04+00:00"}]
---

# Oracle E-Business Suite Product Hub: low-privilege takeover over HTTP

Oracle Product Hub in E-Business Suite 12.2.3 through 12.2.15 has a flaw in its Internal Operations component. A low-privileged user with network access over HTTP can take over the application, with full confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Product Hub (E-Business Suite) affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU

## How to check

Run the EBS Critical Patch Update Checker (ECPUC, Patch 35583866, latest version): ECPUC.sql writes ECPUC.lst showing your current CPU/CSPU level and the missing October 2026 patches. Exposed if you run Product Hub on EBS 12.2.3-12.2.15 without the October 2026 CPU.

## Fix

Apply the Oracle E-Business Suite October 2026 CPU/CSPU patches for release 12.2 (find the current patch list via MOS Article KA923). No standalone workaround documented. Restrict network access to the EBS application tier as a stopgap.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101853
- 2026-10-24T00:05:04+00:00 analyst — Fixed by Oracle October 2026 CPU (cpuoct2026, 20 Oct 2026); EBS-specific patch number for this CVE not read on a primary page (Rapid7 cites 40022426 for sibling CVE-2026-83393 only). No exploitation or PoC found. Armis claim of 'fixed in 12.2.16' for sibling not from Oracle; not used.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [fix] Critical Patch Update for October 2026 Now Available (EBS) https://blogs.oracle.com/ebstech/critical-patch-update-for-october-2026-now-available
- [mitigation] October 2026 Updates to EBS Critical Patch Update Checker (ECPUC) https://blogs.oracle.com/ebstech/october-2026-updates-to-ebs-critical-patch-update-checker-ecpuc

## From the sources

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_