---
id: "CVE-2026-101854"
kind: "vulnerability"
aliases: ["CVE-2026-101854"]
title: "Oracle E-Business Suite Product Hub: low-privilege users can take over the app"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle Product Hub (E-Business Suite)", "fixed": ["October 2026 CPU patch (number in MOS note)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-apps", "oracle-ebs", "package", "product-hub", "self-hosted", "vendor"]
not_affected_if: ["cpu-oct-2026-applied", "product-hub-not-deployed", "version-outside-12.2.3-12.2.15"]
published_at: "2026-10-20T22:18:41+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-24T00:04:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101854", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:04:00+00:00"}]
---

# Oracle E-Business Suite Product Hub: low-privilege users can take over the app

Oracle Product Hub in E-Business Suite 12.2.3 through 12.2.15 (component Internal Operations) has a flaw reachable over HTTP. A low-privilege authenticated user on the network can take over Product Hub, with full confidentiality, integrity and availability impact (CVSS 3.1 8.8). Fixed by the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Product Hub (E-Business Suite) affected >= 12.2.3, <= 12.2.15 fixed October 2026 CPU patch (number in MOS note)

## How to check

Product Hub is part of EBS. If you run EBS 12.2.3-12.2.15 with Product Hub deployed, you are affected unless the October 2026 CPU EBS patches are applied. Check the EBS release and applied patches (Oracle Applications Manager patch history, or ad_bugs / AD_APPLIED_PATCHES) against the EBS patch availability note linked from the October 2026 CPU. Exact patch number: unknown, it is in the MOS note.

## Fix

Apply the Oracle E-Business Suite patches from the October 2026 Critical Patch Update, following the EBS patch availability document on My Oracle Support. Exact patch number: unknown without MOS access. Until then, restrict network access to EBS and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101854
- 2026-10-24T00:04:00+00:00 analyst — Confirmed in CVE record (8.8, AV:N/PR:L, Product Hub Internal Operations, 12.2.3-12.2.15) and Oracle's October 2026 CPU lists EBS 12.2.3-12.2.15. Exact patch number is in a My Oracle Support patch availability note (login required), not read. No exploitation or PoC found; social search not run.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-101854 https://www.cve.org/CVERecord?id=CVE-2026-101854

## From the sources

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub.  Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_