CVE-2026-70725: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-70725 Overview

CVE-2026-70725 is an access control vulnerability [CWE-284] in the Internal Operations component of Oracle Advanced Inbound Telephony, part of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access via HTTP can exploit the flaw to compromise the application. Successful exploitation results in unauthorized read access to all accessible data, limited modification of some data, and partial denial of service. Oracle disclosed the issue in the Oracle Security Alert August 2026.

Critical Impact
Authenticated attackers can read sensitive telephony data, modify records, and degrade service availability through low-complexity HTTP requests.

Affected Products

Oracle E-Business Suite — Oracle Advanced Inbound Telephony 12.2.3
Oracle E-Business Suite — Oracle Advanced Inbound Telephony versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Advanced Inbound Telephony 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70725 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70725

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Advanced Inbound Telephony. Improper access control [CWE-284] allows an authenticated user with minimal privileges to reach functionality that should require higher authorization. The flaw is remotely reachable over HTTP without user interaction and does not require complex prerequisites.

Successful exploitation grants an attacker broad read access to data managed by Oracle Advanced Inbound Telephony. Attackers can also insert, update, or delete a subset of records and induce a partial denial-of-service condition against the module. The confidentiality impact is high because attackers reach the full data scope of the module, while integrity and availability effects are limited in scope.

Root Cause

The root cause is improper enforcement of access controls in the Internal Operations component. Authorization checks fail to sufficiently restrict low-privileged accounts from invoking sensitive telephony operations exposed through the HTTP interface of Oracle E-Business Suite. The EPSS score at publication was 0.31%.

Attack Vector

Exploitation occurs over the network through HTTP requests directed at the Oracle E-Business Suite web tier. The attacker requires a valid low-privileged account. Once authenticated, the attacker crafts requests targeting Advanced Inbound Telephony endpoints associated with Internal Operations to bypass authorization boundaries.

No verified public exploit code is available. The vulnerability mechanism is described in the Oracle Security Alert August 2026 advisory.

Detection Methods for CVE-2026-70725

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts targeting Advanced Inbound Telephony URLs under the Internal Operations component.
Database audit records showing read, insert, update, or delete operations on telephony tables originating from accounts without a business need.
Unusual spikes in application errors or degraded response times from the Advanced Inbound Telephony module consistent with partial denial of service.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and page access tracking for Advanced Inbound Telephony pages and servlets.
Correlate authentication events with subsequent access to Internal Operations endpoints to identify privilege boundary violations.
Deploy a web application firewall in front of the E-Business Suite web tier to log and inspect traffic to Advanced Inbound Telephony URIs.

Monitoring Recommendations

Forward Oracle HTTP Server access logs and Oracle Database audit trails to a centralized analytics platform for behavioral analysis.
Alert on session activity where a low-privileged responsibility issues requests to telephony operations outside its assigned scope.
Monitor for repeated 4xx or 5xx responses from telephony endpoints that may indicate probing or denial-of-service attempts.

How to Mitigate CVE-2026-70725

Immediate Actions Required

Apply the Critical Patch Update referenced in the Oracle Security Alert August 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory user accounts and responsibilities with access to Advanced Inbound Telephony functions and remove entitlements that are not required.
Rotate credentials for any low-privileged accounts suspected of unauthorized use, particularly service and integration accounts.

Patch Information

Oracle addressed CVE-2026-70725 in the August 2026 Security Alert. Administrators should download the appropriate patch for their Oracle E-Business Suite 12.2 release level and apply it during a scheduled maintenance window. Verify the patch is applied by checking the FND_PRODUCT_INSTALLATIONS and AD_BUGS tables after installation.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier so that only authorized internal networks and VPN clients can reach Advanced Inbound Telephony URLs until the patch is applied.
Disable or unassign Advanced Inbound Telephony responsibilities from users who do not have an operational need for the module.
Place a web application firewall rule in monitor or block mode for requests to Internal Operations endpoints originating from unexpected user sessions.

bash

# Verify patch application in Oracle E-Business Suite
sqlplus apps/<password> <<EOF
SELECT bug_number, creation_date
  FROM ad_bugs
 WHERE bug_number = '<CPU_AUG2026_BUG_ID>';
EOF