CVE-2026-70918

Analyzed Analyzed - Analysis Complete

Oracle Product Hub Remote Code Execution

Publication date: 2026-08-18

Last updated on: 2026-08-28

Assigner: Oracle

Description

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Outbound Data). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in takeover of Oracle Product Hub. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-28

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-70918

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	product_hub	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Product Hub, part of Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15. The issue is in the Outbound Data component and allows a low-privileged attacker with network access via HTTP to take over the system. The CVSS score is 8.8, indicating high impact on confidentiality, integrity, and availability.

Detection Guidance

Detection requires checking for Oracle Product Hub versions 12.2.3 to 12.2.15. Review Oracle E-Business Suite logs for unusual HTTP access patterns or unauthorized outbound data activities. No specific commands are provided in the CVE details.

Impact Analysis

An attacker could exploit this to gain full control of Oracle Product Hub, potentially leading to unauthorized access, data theft, or system manipulation. Since it requires low privileges and network access, it poses a significant risk if not patched.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR (data protection) and HIPAA (health data security) requirements. Organizations using affected versions must address it to maintain compliance.

Mitigation Strategies

Apply Oracle's official patches or updates for Oracle Product Hub. Restrict network access to HTTP ports used by Oracle Product Hub. Monitor for suspicious activity and enforce least privilege for user accounts.

Hi! I’m here to help you understand CVE-2026-70918. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70