CVE-2026-70761

HighCVSS 8.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low-privileged attacker via HTTP. Allows takeover of Oracle Risk Management.

Risk Assessment

Risk includes full system takeover, potentially leading to breach of confidentiality, integrity, and availability of risk management data.

Recommendation

Apply Oracle patches and restrict network access and user privileges.

Original NVD description (English source)

Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Risk Management. Successful attacks of this vulnerability can result in takeover of Oracle Risk Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).