CVE-2026-87154: Oracle Product Hub Auth Bypass Vulnerability

CVE-2026-87154 Overview

CVE-2026-87154 is a high-severity vulnerability in the Oracle Product Hub product of Oracle E-Business Suite, within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Product Hub accessible data. The vulnerability is easily exploitable and does not require user interaction.

Critical Impact
An authenticated attacker can gain full read and write access to all data accessible through Oracle Product Hub over the network.

Affected Products

Oracle E-Business Suite — Oracle Product Hub 12.2.3
Oracle E-Business Suite — Oracle Product Hub versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Product Hub 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-87154 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87154

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Product Hub, a master data management module within Oracle E-Business Suite. An attacker holding low-level application privileges can reach the vulnerable functionality over HTTP without any user interaction. Successful exploitation grants both read access and write access to data accessible through the Oracle Product Hub application, which typically includes product master data, item attributes, and catalog information.

Availability is not impacted, meaning the application continues to operate normally while an attacker manipulates or extracts data. Because Oracle Product Hub serves as an authoritative product data repository, tampered records can propagate downstream to procurement, manufacturing, and order management processes.

Root Cause

Oracle has not published detailed root-cause information in the referenced advisory. Based on the CVSS scoring characteristics of low complexity, low privileges required, and no user interaction, the flaw is consistent with a broken access control or authorization enforcement weakness in an HTTP-accessible interface exposed by the Internal Operations component.

Attack Vector

Exploitation requires network reachability to the Oracle E-Business Suite HTTP interface and any authenticated Product Hub account. The attacker sends crafted HTTP requests to the Internal Operations component to invoke functionality that should be restricted, bypassing authorization checks on data operations. No client-side interaction and no elevated privileges are needed.

Refer to the Oracle Security Alert CSPUSEP2026 for authoritative details.

Detection Methods for CVE-2026-87154

Indicators of Compromise

Unexpected HTTP requests from low-privileged Product Hub user accounts to Internal Operations endpoints outside of normal business workflows.
Unauthorized creation, modification, or deletion events in Oracle Product Hub audit tables that cannot be tied to a legitimate change ticket.
Bulk item, catalog, or attribute changes originating from a single session or IP address in a short time window.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page-access tracking to correlate user sessions with Product Hub data changes.
Baseline typical HTTP request patterns for Product Hub users and alert on deviations targeting Internal Operations URLs.
Compare application-level audit trails with database-level FND_LOG and item history tables to identify writes performed outside sanctioned UI workflows.

Monitoring Recommendations

Forward Oracle E-Business Suite application logs, Apache/OHS access logs, and database audit logs to a centralized SIEM for correlation.
Alert on privilege-tier mismatches where accounts with limited responsibilities perform administrative-scope data operations.
Monitor for anomalous outbound data volumes from the Oracle E-Business Suite middle tier that could indicate bulk data extraction.

How to Mitigate CVE-2026-87154

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in Oracle Security Alert CSPUSEP2026 to all Oracle E-Business Suite environments running Product Hub 12.2.3 through 12.2.15.
Inventory all Product Hub user accounts and remove or disable unused, shared, or over-privileged accounts.
Review recent Product Hub audit records for unauthorized data modifications going back to the patch release window.

Patch Information

Oracle addresses this vulnerability through the security patch bundle documented in the Oracle Security Alert CSPUSEP2026. Administrators should apply the patch to every affected E-Business Suite instance and validate the patch level using adop or the AutoPatch inventory. Test the update in a non-production environment prior to production rollout.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP tier so only trusted internal networks and VPN clients can reach the application.
Place a web application firewall in front of the E-Business Suite front end and constrain access to Internal Operations URLs to authorized administrator source addresses.
Enforce strong authentication, including multi-factor authentication, for all Product Hub users to raise the cost of credential-based access.

bash

# Configuration example: restrict access to Oracle EBS HTTP tier at the network edge
# Replace with your trusted administrative CIDR range
iptables -A INPUT -p tcp --dport 8000 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP