CVE-2026-70747 Overview
CVE-2026-70747 is a high-severity vulnerability in the Oracle Customers Online product of Oracle E-Business Suite, specifically within the Customer Tab component. The flaw affects supported versions 12.2.3 through 12.2.15. An authenticated attacker with low privileges and network access via HTTP can exploit this weakness to fully compromise the affected instance. Successful exploitation results in complete takeover of Oracle Customers Online, impacting confidentiality, integrity, and availability. Oracle addressed the issue in an August 2026 security alert.
Critical Impact
Successful exploitation allows a low-privileged remote attacker to take over Oracle Customers Online, gaining full access to customer data and application functions.
Affected Products
- Oracle E-Business Suite — Oracle Customers Online, version 12.2.3
- Oracle E-Business Suite — Oracle Customers Online, versions 12.2.4 through 12.2.14
- Oracle E-Business Suite — Oracle Customers Online, version 12.2.15
Discovery Timeline
- 2026-08-18 - CVE-2026-70747 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-70747
Vulnerability Analysis
The vulnerability resides in the Customer Tab component of Oracle Customers Online, a module within Oracle E-Business Suite (EBS) used for managing customer records. The issue is remotely exploitable over HTTP and requires only low privileges, meaning any authenticated EBS user with basic access to the module can attempt exploitation. No user interaction is required to trigger the flaw.
Oracle categorizes the outcome as full takeover of the Oracle Customers Online product. This indicates the attacker gains control over the confidentiality, integrity, and availability of the module, including customer data stored and processed within it. Oracle EBS deployments are typically internet-facing for partner and self-service portals, expanding the attack surface. The EPSS score of 0.479% suggests limited public exploitation activity at present, though this may change as details emerge.
Root Cause
Oracle has not publicly disclosed the specific root cause. Based on the CVSS metrics and the described impact of complete product takeover from a low-privileged authenticated context, the flaw is consistent with an authorization or input-handling defect in the Customer Tab component. Refer to the Oracle Security Alert for vendor-provided technical context.
Attack Vector
An attacker requires network access to the Oracle EBS HTTP interface and valid low-privileged credentials. From there, the attacker interacts with the Customer Tab component through crafted HTTP requests. Because the scope is unchanged and the attacker moves from low privilege to full compromise, the flaw effectively enables vertical privilege escalation within the Customers Online product boundary.
No verified proof-of-concept code has been published. See the Oracle Security Alert for authoritative details.
Detection Methods for CVE-2026-70747
Indicators of Compromise
- Unexpected HTTP requests to Oracle Customers Online Customer Tab endpoints from low-privileged user sessions.
- Anomalous administrative actions (customer record modification, mass export, permission changes) originating from non-administrative accounts.
- Session activity from EBS accounts outside their typical access patterns, geographies, or hours.
Detection Strategies
- Enable and review Oracle EBS Sign-On Audit and page access tracking to identify unauthorized use of Customer Tab functions.
- Correlate EBS application logs with web server access logs to flag suspicious HTTP request patterns targeting the Customers Online module.
- Baseline normal usage of the Customer Tab component and alert on deviations in request volume, parameter values, or accessed record counts.
Monitoring Recommendations
- Monitor authentication logs for low-privileged EBS accounts performing high-impact actions immediately after login.
- Track outbound data flows from the EBS application tier for signs of bulk customer data exfiltration.
- Alert on any modifications to EBS responsibility assignments or profile options during and after the vulnerability window.
How to Mitigate CVE-2026-70747
Immediate Actions Required
- Apply the fixes referenced in the Oracle Critical Patch Update / Security Alert for August 2026 to all affected Oracle E-Business Suite 12.2.3–12.2.15 environments.
- Inventory all internet-exposed EBS instances and prioritize patching of those reachable from untrusted networks.
- Review and reduce the population of low-privileged accounts with access to Oracle Customers Online.
Patch Information
Oracle has released a fix as part of the August 2026 security alert cycle. Administrators should consult the Oracle Security Alert for the specific patch identifiers applicable to their Oracle E-Business Suite version and apply them following Oracle's documented EBS patching procedures.
Workarounds
- Restrict network access to Oracle EBS HTTP endpoints using web application firewall rules or network segmentation until patches are applied.
- Temporarily disable or restrict access to the Customer Tab component for non-essential users.
- Enforce multi-factor authentication on all Oracle EBS accounts to raise the cost of credential-based access.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
