{"id":"CVE-2026-101854","kind":"vulnerability","aliases":["CVE-2026-101854"],"related":[],"title":"Oracle E-Business Suite Product Hub: low-privilege users can take over the app","description":"Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Product Hub in E-Business Suite 12.2.3 through 12.2.15 (component Internal Operations) has a flaw reachable over HTTP. A low-privilege authenticated user on the network can take over Product Hub, with full confidentiality, integrity and availability impact (CVSS 3.1 8.8). Fixed by the October 2026 Critical Patch Update.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Product Hub (E-Business Suite)","fixed":["October 2026 CPU patch (number in MOS note)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-apps","oracle-ebs","package","product-hub","self-hosted","vendor"],"not_affected_if":["cpu-oct-2026-applied","product-hub-not-deployed","version-outside-12.2.3-12.2.15"],"how_to_check":"Product Hub is part of EBS. If you run EBS 12.2.3-12.2.15 with Product Hub deployed, you are affected unless the October 2026 CPU EBS patches are applied. Check the EBS release and applied patches (Oracle Applications Manager patch history, or ad_bugs / AD_APPLIED_PATCHES) against the EBS patch availability note linked from the October 2026 CPU. Exact patch number: unknown, it is in the MOS note.","fix":"Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, following the EBS patch availability document on My Oracle Support. Exact patch number: unknown without MOS access. Until then, restrict network access to EBS and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:18:41+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:34+00:00","updated_at":"2026-10-24T00:04:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T22:38:34Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for this CVE; unknown for the exact patch name in the sources.","reach":"network","title":"Oracle E-Business Suite Product Hub: low-privilege users can take over the app","impact":"high","summary":"Oracle Product Hub in E-Business Suite versions 12.2.3 through 12.2.15 has a flaw reachable over HTTP. An attacker with a low-privilege account on the network can gain full control of the application, including its data.","category":"package","who_cares":["oracle-ebs","enterprise-apps","product-hub"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over Product Hub, reading and changing its data","analyst_note":"Find the Oracle CPU advisory and patch number for CVE-2026-101854 and any detection guidance; the sources do not give them.","how_to_check":"Check the installed E-Business Suite release and Product Hub patch level against Oracle's advisory; unknown for the exact file or setting to inspect.","needs_analyst":true,"not_affected_if":["version-outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000522,"input_tokens":3062,"output_tokens":431,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory or patch number for this CVE in the Oracle security alerts page to confirm the fixed patch level.","search":"'-101854':19A,22A '-2026':18A,21A '/av':164C '12.2.15':54B,119C '12.2.3':52B,118C '2026':92B '3.1':86B,151C,163C '8.8':87B,154C 'access':129C 'affect':116C 'allow':123C 'app':16A,32B 'attack':126C,138C 'authent':68B 'avail':83B,158C 'base':152C 'busi':4A,50B,107C 'business':28A 'compon':55B,109C 'compromis':133C 'confidenti':80B,155C 'critic':93B 'cve':17A,20A 'cvss':85B,150C,160C,162C 'e':3A,27A,49B,106C 'e-busi':2A,48B,105C 'e-business':26A 'easili':120C 'eb':35B 'enterpris':31B 'enterprise-app':30B 'exploit':121C 'fix':88B 'flaw':60B 'full':79B 'h':172C 'h/a':171C 'h/i':170C 'host':42B 'http':63B,131C 'hub':7A,25A,39B,46B,77B,101C,136C,149C 'impact':84B,159C 'integr':81B,156C 'intern':56B,110C 'l/pr':166C 'l/ui':167C 'low':9A,66B,124C 'low-privileg':8A,65B 'n/ac':165C 'n/s':168C 'network':72B,128C 'octob':91B 'oper':57B,111C 'oracl':1A,34B,44B,99C,104C,134C,147C 'oracle':23A 'oracle-eb':33B 'packag':36B 'patch':94B 'privileg':10A,67B,125C 'product':6A,24A,38B,45B,76B,100C,102C,135C,148C 'product-hub':37B 'reachabl':61B 'result':143C 'score':153C 'self':41B 'self-host':40B 'success':137C 'suit':5A,51B,108C 'suite':29A 'support':112C 'take':13A,74B 'takeov':145C 'u/c':169C 'updat':95B 'user':11A,69B 'vector':161C 'vendor':43B 'version':113C 'via':130C 'vulner':96C,122C,141C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101854","severity":null,"published_at":"2026-10-20T22:18:41+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101854:580","url":null,"severity":null,"published_at":"2026-10-24T00:04:00+00:00","modified_at":"2026-10-24T00:04:00+00:00","first_seen_at":"2026-10-24T00:04:00+00:00","fetched_at":"2026-10-24T00:04:00+00:00","note":"Confirmed in CVE record (8.8, AV:N/PR:L, Product Hub Internal Operations, 12.2.3-12.2.15) and Oracle's October 2026 CPU lists EBS 12.2.3-12.2.15. Exact patch number is in a My Oracle Support patch availability note (login required), not read. No exploitation or PoC found; social search not run."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2331,"url":"https://www.cve.org/CVERecord?id=CVE-2026-101854","title":"CVE Record: CVE-2026-101854","kind":"other","source":"analyst","text":"Oracle Product Hub (EBS, component Internal Operations), 12.2.3-12.2.15, low-privileged attacker, network via HTTP, takeover of Product Hub. CVSS 3.1 8.8 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. References Oracle advisory.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}