CVE-2026-83485: Oracle Product Hub Information Disclosure

CVE-2026-83485 Overview

CVE-2026-83485 is a high-severity vulnerability in the Oracle Product Hub product within Oracle E-Business Suite, specifically affecting the Item Catalog component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the vulnerability to compromise Oracle Product Hub. While the vulnerability resides in Oracle Product Hub, successful exploitation triggers a scope change and may significantly impact additional products. The primary impact is confidentiality, enabling unauthorized access to critical data or complete access to all Oracle Product Hub accessible data.

Critical Impact
Authenticated attackers can gain unauthorized read access to sensitive data across Oracle Product Hub and adjacent products through a network-accessible HTTP interface.

Affected Products

Oracle E-Business Suite - Oracle Product Hub 12.2.3
Oracle E-Business Suite - Oracle Product Hub versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Product Hub 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-83485 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83485

Vulnerability Analysis

The vulnerability affects the Item Catalog component of Oracle Product Hub, a module responsible for managing product master data across Oracle E-Business Suite. An authenticated attacker holding low privileges can send crafted HTTP requests to the exposed interface and obtain sensitive information beyond the scope of their authorization.

The scope change property in the CVSS vector indicates that the vulnerable component and the impacted component differ. Exploitation of the Item Catalog module can therefore expose data controlled by adjacent products within the E-Business Suite deployment.

The impact is limited to confidentiality. Integrity and availability of the target system are not affected, according to the Oracle Security Alert.

Root Cause

Oracle has not published a detailed root-cause analysis. Based on the CVSS metrics and Oracle's advisory language, the flaw stems from insufficient authorization enforcement in the Item Catalog component, allowing a low-privileged user to access data outside their intended access boundary. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative details.

Attack Vector

Attack traffic reaches the vulnerable component over the network via HTTP. The attacker must hold valid low-privilege credentials for the Oracle E-Business Suite environment. No user interaction is required, and exploit complexity is low. Public proof-of-concept code is not available, and CISA has not listed the CVE in its Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.371%.

No verified code examples are available. See the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Detection Methods for CVE-2026-83485

Indicators of Compromise

Unexpected HTTP requests to Oracle Product Hub Item Catalog endpoints originating from low-privileged accounts.
Access patterns showing a single user retrieving Item Catalog data volumes inconsistent with their role.
Cross-module data reads that traverse product boundaries within Oracle E-Business Suite.

Detection Strategies

Review Oracle E-Business Suite audit logs for unusual Item Catalog query activity by non-administrative users.
Correlate web server access logs with application-tier authorization events to identify scope-boundary violations.
Baseline normal Product Hub query patterns per role, then alert on statistical deviations.

Monitoring Recommendations

Forward Oracle E-Business Suite application and HTTP access logs to a centralized SIEM for continuous analysis.
Enable Oracle Fine Grained Auditing (FGA) on sensitive Item Catalog tables to capture read access events.
Monitor for authentication anomalies against E-Business Suite low-privilege accounts that may indicate credential abuse.

How to Mitigate CVE-2026-83485

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected Oracle E-Business Suite deployments running Product Hub versions 12.2.3 through 12.2.15.
Inventory all Product Hub installations and confirm exposure of the Item Catalog component to network-accessible HTTP interfaces.
Rotate credentials for low-privileged accounts that have access to Product Hub if exploitation is suspected.

Patch Information

Oracle released fixes as part of the Oracle Security Alert CSPUSEP2026. Administrators should download and apply the corresponding patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15. Consult the Oracle Security Alert CSPUSEP2026 for patch identifiers, prerequisites, and application instructions.

Workarounds

Restrict HTTP access to Oracle Product Hub interfaces to trusted network segments using firewall or reverse-proxy rules.
Enforce least-privilege on Oracle E-Business Suite responsibilities, reducing the number of accounts able to interact with the Item Catalog component.
Enable enhanced auditing on Product Hub modules to increase visibility until the patch is applied.

bash

# Example: restrict HTTP access to Oracle E-Business Suite Product Hub endpoints
# Replace <trusted_subnet> and <ebs_host> with environment-specific values
iptables -A INPUT -p tcp --dport 8000 -s <trusted_subnet> -d <ebs_host> -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -d <ebs_host> -j DROP