CVE-2026-70791
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Vulnerability in Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low privileged attacker with network access via HTTP, requires user interaction. Allows unauthorized creation, deletion or modification of critical data and unauthorized read access to a subset of data. Attacks may impact additional products (scope change).
Risk Assessment
Risk of integrity and confidentiality breach in the transportation system, with potential impact on other systems, possibly leading to supply chain disruptions.
Recommendation
Apply Oracle patches for versions 12.2.3-12.2.15. Restrict network access and educate users about interactions with the system.
Original NVD description (English source)
Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Execution. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Transportation Execution, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Transportation Execution accessible data as well as unauthorized read access to a subset of Oracle Transportation Execution accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N).