CVE-2026-70701
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Vulnerability in Oracle Payables (component: Internal Operations) versions 12.2.3-12.2.15. A low-privileged attacker can gain unauthorized access to critical data and modify or delete it via HTTP.
Risk Assessment
Risk includes unauthorized modification or deletion of critical Oracle Payables data, potentially compromising financial data integrity.
Recommendation
Apply Oracle patches for Oracle Payables and restrict user privileges to the minimum necessary.
Other vulnerabilities in Oracle Payables
See all- CVE-2026-70700High
Vulnerability in Oracle Payables (component: Internal Operations) versions 12.2.3-12.2.15. An unauthenticated attacker can cause a hang or frequent crashes (full DoS) of Oracle Payables via HTTP.
- CVE-2026-61320High
Vulnerability in Oracle Payables (Oracle E-Business Suite) component Internal Operations. Versions 12.2.8-12.2.15 are affected. A low-privileged attacker with network access via HTTP can compromise Oracle Payables.
Original NVD description (English source)
Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payables. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payables accessible data as well as unauthorized access to critical data or complete access to all Oracle Payables accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS