Live › vulnerability › CVE-2026-101855
Go to dashboardOracle Product Hub, part of Oracle E-Business Suite, has a flaw in its Internal Operations component that lets an attacker with a low-privileged account reach it over HTTP. A successful attack gives unauthorized read access to critical data held in Product Hub.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Product Hub module reachable over HTTP. Attackers need a valid low-privileged account, so exposure depends on who holds such accounts. Teams without Oracle Product Hub or on versions outside the listed range can likely skip it.
No product ranges from the sources yet.
12.2.3 through 12.2.15, and whether Oracle Product Hub is installed and reachable over HTTPEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
This page as .md · .json · in your agent: get_signal("CVE-2026-101855")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.