CVE-2026-87156: Oracle Product Hub Auth Bypass Vulnerability

CVE-2026-87156 Overview

CVE-2026-87156 is a high-severity vulnerability in the Oracle Product Hub product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can exploit the vulnerability to compromise Oracle Product Hub. Successful exploitation results in unauthorized access to critical data, or complete read access to all data accessible through Oracle Product Hub. Attackers can also perform unauthorized update, insert, or delete operations on a subset of accessible data.

Critical Impact
Authenticated network attackers can gain full read access and partial write access to data managed by Oracle Product Hub, exposing sensitive product master data.

Affected Products

Oracle Product Hub version 12.2.3 through 12.2.15
Oracle E-Business Suite (Internal Operations component)
Deployments exposing the Product Hub HTTP interface to authenticated users

Discovery Timeline

2026-09-15 - CVE-2026-87156 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87156

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Product Hub, a module of Oracle E-Business Suite used for master data management of product information. An authenticated attacker holding low privileges can send crafted HTTP requests to compromise the application. The flaw yields high confidentiality impact and low integrity impact, with no availability impact. Because Product Hub aggregates product master data across the enterprise, unauthorized read access exposes sensitive commercial information such as SKUs, pricing structures, supplier relationships, and internal product roadmaps.

Oracle has not published component-level technical detail beyond the security alert. The description indicates that exploitation requires network access via HTTP and does not require user interaction, meaning the attack can be scripted against exposed E-Business Suite instances.

Root Cause

Oracle's advisory does not disclose the specific root cause. Based on the attack profile (authenticated HTTP access producing broad data disclosure and partial data modification), the flaw is consistent with a broken access control or authorization bypass condition in the Internal Operations component. See the Oracle Security Alert for authoritative details.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle E-Business Suite front end. The attacker must hold a low-privileged, valid account in the target environment. No user interaction is required, and the scope is unchanged. The attacker sends crafted requests to Product Hub endpoints exposed by the Internal Operations component to read or modify data outside their intended authorization boundary.

No public proof-of-concept, exploit code, or CISA KEV listing exists for this CVE at publication time. Real code examples are not available; refer to Oracle's advisory for remediation-specific guidance.

Detection Methods for CVE-2026-87156

Indicators of Compromise

Unexpected HTTP requests from low-privileged user accounts targeting Product Hub Internal Operations URLs
Access log entries showing a single authenticated session enumerating large volumes of Product Hub records
Unauthorized INSERT, UPDATE, or DELETE operations in Product Hub database audit logs originating from non-administrative users
Anomalous outbound data transfers from application servers hosting Oracle E-Business Suite

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and application-tier audit logging to capture user activity against Product Hub modules
Correlate HTTP access logs with database audit records to identify authorization boundary violations
Baseline normal Product Hub query volumes per user role and alert on statistical deviations

Monitoring Recommendations

Forward Oracle E-Business Suite application, web tier, and database audit logs to a centralized SIEM for correlation
Monitor for privilege enumeration behavior following successful low-privileged authentication events
Alert on bulk data extraction patterns against Product Hub tables such as MTL_SYSTEM_ITEMS_B and related master data schemas

How to Mitigate CVE-2026-87156

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected Product Hub deployments
Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and prioritize internet-facing systems
Review recent audit logs for evidence of unauthorized data access by low-privileged accounts prior to patching
Rotate credentials for any accounts suspected of misuse during the exposure window

Patch Information

Oracle addressed CVE-2026-87156 in the Oracle Critical Patch Update referenced in the September 2026 Security Alert. Administrators must download and apply the fix from My Oracle Support following Oracle's documented E-Business Suite patching procedures. Consult the Oracle Security Alert for exact patch identifiers and prerequisites.

Workarounds

Restrict network access to the Oracle E-Business Suite HTTP interface using firewall rules and reverse proxy allow-lists until patching completes
Enforce least-privilege responsibilities in Oracle E-Business Suite so users only receive Product Hub access strictly required for their role
Require VPN or zero-trust network access for any user session that interacts with Oracle Product Hub
Enable Oracle Database Vault or equivalent controls to constrain unauthorized data modification on Product Hub tables

bash

# Configuration example: restrict access to the EBS HTTP tier at the network perimeter
# Replace addresses with your authorized administrative and user subnets
iptables -A INPUT -p tcp --dport 8000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP