CVE-2026-70729: Oracle Teleservice RCE Vulnerability

CVE-2026-70729 Overview

CVE-2026-70729 is a high-severity vulnerability in the Oracle Teleservice product of Oracle E-Business Suite, specifically within the Service Request Form component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability to compromise Oracle Teleservice. Successful exploitation results in full takeover of the Teleservice application, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert August 2026.

Critical Impact
Authenticated attackers over the network can achieve complete takeover of Oracle Teleservice, exposing customer service data and workflows to unauthorized access, modification, and destruction.

Affected Products

Oracle E-Business Suite - Oracle Teleservice 12.2.3
Oracle E-Business Suite - Oracle Teleservice versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Teleservice 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70729 published to the National Vulnerability Database
2026-08-20 - CVE-2026-70729 last updated in the NVD database

Technical Details for CVE-2026-70729

Vulnerability Analysis

The vulnerability resides in the Service Request Form component of Oracle Teleservice, a customer service and support module of Oracle E-Business Suite. Oracle classifies the issue as easily exploitable by an authenticated attacker with only low privileges. The attacker requires no user interaction and communicates with the vulnerable application over standard HTTP.

Successful exploitation grants the attacker full takeover of the Teleservice product. This includes unauthorized read access to service request records, the ability to modify or destroy data, and disruption of service availability. Because Teleservice integrates with broader E-Business Suite modules, an attacker can pivot from compromised service request workflows into adjacent customer and financial data flows.

The EPSS probability is 0.479% (percentile 39.5), indicating a moderate near-term exploitation likelihood relative to the CVE population. However, Oracle E-Business Suite deployments are historically high-value targets for opportunistic attackers.

Root Cause

Oracle has not published detailed root-cause information beyond confirming the vulnerable component is the Service Request Form in Oracle Teleservice. The advisory attributes the flaw to insufficient enforcement within Teleservice request handling that permits an authenticated low-privileged account to escalate its effective control over the application.

Attack Vector

The attack vector is network-based over HTTP. The attacker needs valid low-privileged credentials to the E-Business Suite instance but does not require any administrative role or user interaction. Any exposed Teleservice endpoint reachable by authenticated business users, contractors, or partners is in scope. Refer to the Oracle Security Alert August 2026 for vendor guidance.

No public proof-of-concept exploit code is available at the time of publication.

Detection Methods for CVE-2026-70729

Indicators of Compromise

Unexpected creation, modification, or deletion of records in Teleservice Service Request tables by low-privileged accounts.
HTTP POST or GET requests to Service Request Form endpoints originating from user accounts that do not normally interact with Teleservice.
New or elevated database sessions launched from Oracle Application Server processes associated with the Teleservice module.

Detection Strategies

Baseline normal Teleservice usage per user role and alert on statistical outliers in request volume, endpoint access, or data modification patterns.
Enable and forward Oracle E-Business Suite Sign-On Audit and Function Security audit logs to a centralized SIEM for correlation with network telemetry.
Inspect application-tier and reverse-proxy logs for anomalous parameters submitted to Service Request Form URLs.

Monitoring Recommendations

Forward Oracle EBS application logs, database audit trails, and web-tier logs into a centralized data lake for cross-source correlation.
Monitor for privilege changes on Teleservice-related responsibilities and for unexpected use of shared or service accounts.
Alert on any Teleservice access from IP ranges outside the documented business user population.

How to Mitigate CVE-2026-70729

Immediate Actions Required

Apply the patches in the Oracle Security Alert August 2026 to all Oracle E-Business Suite Teleservice deployments running versions 12.2.3 through 12.2.15.
Inventory internet-exposed Teleservice endpoints and restrict access to authenticated corporate networks or VPN clients until patched.
Rotate credentials for low-privileged EBS accounts and review recent Teleservice activity for signs of misuse.

Patch Information

Oracle released fixes for CVE-2026-70729 as part of the Oracle Security Alert published on August 2026. Administrators should apply the corresponding Teleservice patch for their E-Business Suite 12.2.x release. Refer to the Oracle Security Alert August 2026 for the specific patch identifiers and installation prerequisites.

Workarounds

Restrict network reachability of the Service Request Form endpoints using web application firewall rules or reverse-proxy allow-lists until patches are deployed.
Reduce the number of accounts granted Teleservice responsibilities to the minimum required for business operations.
Enable enhanced auditing on Teleservice function calls to detect exploitation attempts pending remediation.

bash

# Example: restrict Teleservice URLs at the reverse proxy (nginx)
location ~* /OA_HTML/.*Teleservice.* {
    allow 10.0.0.0/8;      # internal corporate range
    allow 192.168.0.0/16;  # VPN range
    deny all;
    proxy_pass http://ebs-backend;
}