CVE-2026-70755: Oracle E-Business Suite Data Exposure Flaw

CVE-2026-70755 Overview

CVE-2026-70755 is an access control weakness in the File download component of Oracle Web Applications Desktop Integrator, part of Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.15 are affected. An authenticated attacker with low privileges and network access over HTTP can exploit the flaw to obtain unauthorized access to sensitive data managed by the application. The issue is classified under [CWE-284: Improper Access Control] and impacts confidentiality only. Oracle addressed the vulnerability in a security alert published in September 2026.

Critical Impact
Successful exploitation grants unauthorized access to critical data or complete access to all data reachable through Oracle Web Applications Desktop Integrator.

Affected Products

Oracle E-Business Suite — Oracle Web Applications Desktop Integrator 12.2.3
Oracle E-Business Suite — Oracle Web Applications Desktop Integrator 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Web Applications Desktop Integrator 12.2.15

Discovery Timeline

2026-09-15 - CVE-2026-70755 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-70755

Vulnerability Analysis

The vulnerability resides in the File download component of Oracle Web Applications Desktop Integrator (Web ADI). Web ADI extends Oracle E-Business Suite by allowing users to move data between desktop applications such as Microsoft Excel and Oracle EBS. The flaw allows a low-privileged, authenticated user to reach data that access controls should restrict. The exposure is limited to confidentiality; integrity and availability are not affected.

Oracle categorizes the issue as easily exploitable over HTTP. Because Web ADI typically operates within the trust boundary of an EBS deployment, any authenticated EBS user who can reach the download endpoint may retrieve data belonging to other users or business units.

Root Cause

The root cause is improper access control [CWE-284] in the file download path of Web ADI. Authorization checks are insufficient to prevent an authenticated user from requesting content they are not entitled to receive. Oracle's advisory does not disclose the specific endpoint or parameter involved.

Attack Vector

Exploitation requires network access to the Oracle E-Business Suite HTTP interface and a valid low-privileged EBS account. No user interaction is required, and the attack does not cross a security boundary such as another EBS instance. Refer to the Oracle Security Alert CSPUSEP2026 for details Oracle has released to licensed customers.

No public proof-of-concept exploit code is available. The EPSS forecast places exploitation probability at 0.27% (19.3 percentile) as of 2026-09-16.

Detection Methods for CVE-2026-70755

Indicators of Compromise

Unexpected HTTP requests to Web ADI download endpoints from user accounts that do not normally use the module.
High volumes of successful file download responses from a single low-privileged EBS session.
Access to Web ADI content from source IP addresses outside typical business locations or hours.

Detection Strategies

Enable Oracle E-Business Suite auditing on Web ADI URLs and correlate access with the requesting user's assigned responsibilities.
Baseline normal Web ADI download activity per user and alert on deviations in request rate, file size, or accessed document types.
Inspect web server and application logs for parameter manipulation patterns targeting Web ADI download servlets.

Monitoring Recommendations

Ship Oracle HTTP Server and EBS FND logs to a central analytics platform for longitudinal review.
Alert on authenticated users retrieving data outside their organizational unit or ledger scope.
Review privileged and shared service accounts that interact with Web ADI for signs of credential abuse.

How to Mitigate CVE-2026-70755

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 for all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory EBS accounts and disable inactive or unnecessary low-privileged users who could reach Web ADI.
Restrict network access to the EBS HTTP interface using firewalls, reverse proxies, or VPN gating.

Patch Information

Oracle released remediation guidance for CVE-2026-70755 in the Oracle Security Alert CSPUSEP2026. Customers should consult My Oracle Support for patch numbers that match their exact E-Business Suite maintenance level and apply the fix during the next maintenance window.

Workarounds

Where the Web ADI module is not required, disable the associated responsibilities and menu entries to remove the attack surface.
Enforce least privilege on EBS responsibilities so that only users with a business need can invoke Web ADI functions.
Place a web application firewall in front of the EBS HTTP tier and block anomalous requests to Web ADI download URLs until patches are deployed.

bash

# Configuration example: restrict access to Web ADI endpoints at the reverse proxy
# Replace <trusted_cidr> with your approved administrative network range
<Location /OA_HTML/BneApplicationService>
    Require ip <trusted_cidr>
</Location>
<Location /OA_HTML/BneDownloadService>
    Require ip <trusted_cidr>
</Location>