CVE-2026-87153: Oracle Product Hub Auth Bypass Vulnerability

CVE-2026-87153 Overview

CVE-2026-87153 is a high-severity vulnerability in the Oracle Product Hub component of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Product Hub. Successful exploitation allows unauthorized creation, deletion, or modification of critical data. It also enables unauthorized read access to all Oracle Product Hub accessible data.

Critical Impact
Authenticated attackers can gain full read and write access to Oracle Product Hub data over the network, compromising the confidentiality and integrity of enterprise product master data.

Affected Products

Oracle E-Business Suite - Oracle Product Hub version 12.2.3
Oracle E-Business Suite - Oracle Product Hub versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Product Hub version 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87153 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87153

Vulnerability Analysis

CVE-2026-87153 affects the Internal Operations component of Oracle Product Hub within Oracle E-Business Suite. The vulnerability is remotely exploitable over HTTP and requires only low-level authenticated privileges. No user interaction is needed to trigger the flaw.

Successful exploitation grants attackers read access to all Oracle Product Hub accessible data. Attackers can also create, delete, or modify critical product master data records. This creates risk for organizations that rely on Product Hub for master data management, product lifecycle information, and supply chain data.

Because Oracle Product Hub centralizes product information across enterprise operations, downstream systems consuming this data can be affected by unauthorized modifications. Data poisoning attacks against product catalogs, pricing, or specifications can cascade into ERP, procurement, and manufacturing workflows.

Root Cause

Oracle has not published detailed root cause analysis for this vulnerability. The CVSS vector indicates the flaw is exploitable over the network with low attack complexity and requires low privileges. The impact profile suggests missing or improperly enforced authorization checks within the Internal Operations component. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative vendor details.

Attack Vector

An authenticated attacker with any low-privileged account sends crafted HTTP requests to Oracle Product Hub endpoints exposed by the Internal Operations component. The attacker leverages the missing authorization enforcement to invoke functions that read or modify data outside their intended scope. No local access, elevated privileges, or user interaction is required to complete the attack chain.

The vulnerability mechanism is described in prose only; no verified public exploit code is available at this time. See the Oracle Security Alert CSPUSEP2026 for vendor-authoritative technical details.

Detection Methods for CVE-2026-87153

Indicators of Compromise

Unexpected HTTP requests to Oracle Product Hub Internal Operations endpoints originating from low-privileged user sessions.
Unauthorized INSERT, UPDATE, or DELETE operations against Product Hub tables logged in Oracle E-Business Suite audit trails.
Anomalous access patterns to product master data from accounts that do not typically interact with Product Hub.

Detection Strategies

Enable Oracle E-Business Suite Signed Application Server audit logging and forward events to a central analytics platform for correlation.
Baseline normal Product Hub API and page access per user role, then alert on deviations such as bulk reads or modifications.
Correlate authentication events with subsequent Product Hub data access to identify low-privileged accounts performing high-impact operations.

Monitoring Recommendations

Monitor web application firewall and reverse proxy logs for unusual HTTP request volumes to Product Hub URLs.
Track database-level changes to Product Hub schemas using Oracle Database Auditing or Oracle Audit Vault.
Review Oracle E-Business Suite user activity reports weekly for privilege usage that falls outside job function.

How to Mitigate CVE-2026-87153

Immediate Actions Required

Apply the Oracle Security Alert CSPUSEP2026 patch to all affected Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle Product Hub deployments and confirm patch status across production, staging, and disaster recovery instances.
Review and reduce the population of accounts with any level of Product Hub access to enforce least privilege.

Patch Information

Oracle addresses CVE-2026-87153 in the security update referenced by Oracle Security Alert CSPUSEP2026. Administrators should apply the corresponding Critical Patch Update to affected Oracle E-Business Suite 12.2.x deployments. Follow Oracle's documented patch application procedures for E-Business Suite to preserve customizations and dependencies.

Workarounds

Restrict network access to Oracle E-Business Suite web tier interfaces using firewall rules and VPN-only access where feasible.
Place a web application firewall in front of Oracle E-Business Suite to filter anomalous requests to Product Hub endpoints.
Disable or restrict user accounts that do not require Product Hub access until patching is complete.

bash

# Configuration example: restrict access to Oracle EBS Product Hub URLs at the reverse proxy layer
# Consult Oracle EBS documentation before applying in production
<Location /OA_HTML/ProductHub>
    Require ip 10.0.0.0/8
    Require valid-user
</Location>