CVE-2025-53043
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1.
Risk Assessment
An attacker can modify or delete critical data and gain unauthorized access to it, potentially severely impacting data integrity and confidentiality. The risk applies to organizations using Oracle Product Hub versions 12.2.3-12.2.14.
Recommendation
Apply available Oracle updates for Oracle Product Hub. Restrict network access to the system and monitor for unusual data operations.
Other vulnerabilities in Oracle Product Hub
See all- CVE-2026-83393High
Vulnerability in Oracle Product Hub (Internal Operations component) affecting versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with HTTP network access to take over Oracle Product Hub, with impact potentially extending beyond this product.
- CVE-2026-101855Medium
Vulnerability in Oracle Product Hub (Internal Operations component) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a remote low-privileged attacker to gain unauthorized access to critical data or all accessible data.
- CVE-2026-101854High
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub.
- CVE-2026-101853High
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub.
- CVE-2026-101852High
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations), affecting versions 12.2.3-12.2.15. An easily exploitable vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Product Hub.
- CVE-2026-87156High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify some data via HTTP.
- CVE-2026-87155High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can compromise the system over HTTP, leading to full takeover.
- CVE-2026-87154High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can create, delete, or modify critical data and gain full access via HTTP.
- CVE-2026-87153High
Vulnerability in Oracle Product Hub (component: Internal Operations) in versions 12.2.3-12.2.15. A low-privileged attacker can create, delete, or modify critical data and gain full access via HTTP.
- CVE-2026-83487High
Vulnerability in Oracle Product Hub within Oracle E-Business Suite (component: Item Catalog) affecting versions 12.2.3-12.2.15. An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the system. It can lead to unauthorized access to critical data, and the attack may impact additional products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Product Hub accessible data as well as unauthorized access to critical data or complete access to all Oracle Product Hub accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS