CVE-2026-70681
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Vulnerability in Oracle Applications DBA (component: JRI and other Java utilities) affects versions 12.2.3-12.2.15. It is difficult to exploit, requires user interaction, but allows an unauthenticated attacker via HTTP to take over the application.
Risk Assessment
An attacker can take over the Oracle Applications DBA application, potentially leading to full compromise of data and system.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15. Educate users about the risk of interacting with unknown links.
Other vulnerabilities in Oracle Applications DBA
See all- CVE-2026-70680High
Vulnerability in Oracle Applications DBA (component: Internal Operations) affects versions 12.2.3-12.2.15. It is easily exploitable by a low-privileged attacker via HTTP, allowing unauthorized access to critical data and partial denial of service.
- CVE-2026-61107High
Vulnerability in Oracle Applications DBA (Oracle E-Business Suite) allows a high-privileged attacker with network access via HTTP to take over the system. Affects versions 12.2.3-12.2.15.
Original NVD description (English source)
Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: JRI and other Java utils). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Applications DBA. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS