CVE-2026-70798

HighCVSS 7.8

Published: 18/08/2026(UTC)Updated: 20/08/2026(UTC)Translated: 19/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.13%

3th percentile - higher than 3% of all known CVEs

Summary

Vulnerability in Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Affects versions 12.2.3-12.2.15. Easily exploitable by low privileged attacker with logon to the infrastructure, allowing takeover of Oracle Purchasing.

Risk Assessment

Risk of complete takeover of Oracle Purchasing, potentially leading to full compromise of confidentiality, integrity and availability of data.

Recommendation

Apply Oracle patches for versions 12.2.3-12.2.15. Restrict local access to the infrastructure and monitor activities of low privileged users.

Original NVD description (English source)

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Purchasing executes to compromise Oracle Purchasing. Successful attacks of this vulnerability can result in takeover of Oracle Purchasing. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).