CVE-2026-70755
MediumCVSS 6.5Summary
Vulnerability in Oracle Web Applications Desktop Integrator (component: File download) affecting versions 12.2.3-12.2.15. A low privileged attacker with network access via HTTP can easily exploit it, resulting in unauthorized access to critical data or complete access to all accessible data.
Risk Assessment
An organization may experience leakage of confidential business data from Oracle E-Business Suite. The vulnerability is easy to exploit, increasing the risk.
Recommendation
Immediately apply the Oracle patches for the File download component in versions 12.2.3-12.2.15 and consider restricting access to this component.
Other vulnerabilities in Oracle Web Applications Desktop Integrator
See all- CVE-2026-83131High
Vulnerability in the Oracle Web Applications Desktop Integrator product (File download component) of Oracle E-Business Suite, affecting versions 12.2.3-12.2.15. A low privileged authenticated attacker with network access via HTTPS can compromise the product. The vulnerability may also significantly impact additional products (scope change).
- CVE-2017-10323High
Vulnerability in the Oracle Web Applications Desktop Integrator component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.
- CVE-2016-3522High
Unspecified vulnerability in the Oracle Web Applications Desktop Integrator component in Oracle E-Business Suite 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via vectors related to Application Service.
Original NVD description (English source)
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Applications Desktop Integrator accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).