CVE-2026-61275: Oracle Product Hub Auth Bypass Flaw

CVE-2026-61275 Overview

CVE-2026-61275 is an improper access control vulnerability [CWE-284] in the Role Based Security component of Oracle Product Hub, part of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the weakness without user interaction. Successful exploitation grants unauthorized update, insert, or delete access to a subset of Oracle Product Hub data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service.

Critical Impact
An authenticated remote attacker can tamper with Oracle Product Hub data and degrade service availability without user interaction.

Affected Products

Oracle E-Business Suite — Oracle Product Hub
Supported versions 12.2.3 through 12.2.15
Component: Role Based Security

Discovery Timeline

2026-07-21 - CVE-2026-61275 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update, July 2026

Technical Details for CVE-2026-61275

Vulnerability Analysis

The vulnerability resides in the Role Based Security component of Oracle Product Hub. Role Based Security is responsible for enforcing which users can view or modify item, catalog, and product data within the Product Hub module. Improper access control [CWE-284] allows an attacker with a valid low-privilege account to bypass intended role restrictions.

The issue is network-exploitable over HTTP, requires no user interaction, and has low attack complexity. Exploitation impacts confidentiality, integrity, and availability, though each dimension is partial rather than complete. An attacker gains access limited to a subset of Product Hub data and can cause only a partial denial of service.

The EPSS score is 0.249% with a percentile of 16.34, indicating a low probability of exploitation activity in the near term. No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported at the time of publication.

Root Cause

The root cause is improper enforcement of role-based access controls within Oracle Product Hub. Authorization checks fail to correctly validate the caller's role against the requested data operation. As a result, a user holding only low-privilege application credentials can perform actions that should be restricted to higher-privileged roles.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP endpoint and valid low-privileged Product Hub credentials. The attacker issues crafted HTTP requests to Product Hub interfaces that invoke functions or data operations outside their assigned role. Because no user interaction is required, exploitation can be scripted against exposed instances. See the Oracle Security Alert - July 2026 for technical remediation details.

Detection Methods for CVE-2026-61275

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE operations against Product Hub item, catalog, or category tables from low-privileged accounts.
HTTP requests to Product Hub URLs originating from user sessions whose assigned roles do not include write permissions.
Application audit log entries showing role assertions inconsistent with the underlying user's granted responsibilities.

Detection Strategies

Enable Oracle E-Business Suite audit trails (FND_LOGINS, FND_LOGIN_RESPONSIBILITIES, and Product Hub audit tables) and alert on data modifications performed by non-administrative users.
Review web tier access logs for repeated requests to Product Hub endpoints from a single low-privilege session.
Correlate database-level DML events with the invoking application user to identify role-boundary violations.

Monitoring Recommendations

Baseline normal Product Hub user activity by role and alert on statistical deviations, particularly on write operations.
Forward Oracle EBS application, database, and middle-tier logs to a centralized analytics platform for cross-source correlation.
Monitor Oracle Concurrent Manager for unusual programs launched by low-privileged users interacting with Product Hub.

How to Mitigate CVE-2026-61275

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle E-Business Suite Product Hub without delay.
Inventory all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15 and prioritize patching internet-facing instances.
Review Product Hub responsibility and role assignments and revoke unnecessary access from low-privileged accounts.
Rotate credentials for any accounts suspected of exposure or misuse.

Patch Information

Oracle addressed CVE-2026-61275 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert - July 2026 advisory for the specific patch identifiers applicable to your Oracle E-Business Suite release. Apply the patch in a test environment before production rollout.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier using firewall rules, VPN, or reverse proxy allowlists until the patch is deployed.
Tighten responsibility assignments in Product Hub so that low-privileged users cannot reach the affected functions.
Enable enhanced application and database auditing on Product Hub tables to shorten the detection window while patching is scheduled.

bash

# Verify installed Oracle E-Business Suite patch level and Product Hub version
sqlplus apps/<password> <<EOF
SELECT release_name FROM fnd_product_groups;
SELECT bug_number, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<CPUJUL2026_BUG_ID>')
 ORDER BY last_update_date DESC;
EXIT;
EOF