CVE-2026-70764: Oracle General Ledger Auth Bypass Flaw

CVE-2026-70764 Overview

CVE-2026-70764 is a high-severity access control weakness in the Oracle General Ledger product of Oracle E-Business Suite, within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. An authenticated attacker with low privileges can exploit the flaw over HTTP without user interaction. Successful exploitation grants unauthorized access to critical General Ledger data, allows limited unauthorized modification or deletion of records, and can trigger a partial denial of service. The weakness is classified under CWE-284: Improper Access Control.

Critical Impact
A low-privileged authenticated attacker with network access to Oracle General Ledger can read all accessible financial data, modify or delete a subset of records, and disrupt service availability.

Affected Products

Oracle E-Business Suite — Oracle General Ledger 12.2.3
Oracle E-Business Suite — Oracle General Ledger versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle General Ledger 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70764 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70764

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle General Ledger. The component fails to properly enforce access control checks against authenticated HTTP requests. As a result, a user holding minimal application privileges can reach functionality and data that should be restricted to higher-privileged roles. The confidentiality impact is the most significant consequence: an attacker gains full read visibility into General Ledger records, which typically include journal entries, ledger balances, and financial reporting data. Integrity and availability effects are limited but include unauthorized writes to a subset of data and partial service disruption.

Root Cause

The root cause is improper access control ([CWE-284]) in server-side authorization logic within Internal Operations. The component does not adequately validate that the calling user is authorized for the requested operation or dataset before returning or modifying General Ledger records.

Attack Vector

Exploitation requires network access over HTTP and a valid low-privileged account on the E-Business Suite instance. No user interaction is needed, and the attack complexity is low. Because Oracle E-Business Suite deployments frequently expose HTTP endpoints to internal users across large enterprise footprints, the exploitable population of low-privileged accounts is typically broad. Technical details are limited to the Oracle Security Alert; see the Oracle Critical Patch Update, August 2026 for authoritative guidance.

Detection Methods for CVE-2026-70764

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts to Oracle General Ledger Internal Operations endpoints
Anomalous read volumes against GL_* tables or ledger reporting URLs originating from non-finance user sessions
Unauthorized INSERT, UPDATE, or DELETE operations on General Ledger records outside of scheduled batch windows

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and page access auditing for General Ledger responsibilities, then baseline normal usage per role
Correlate application-layer logs with database audit events to flag privilege boundary violations across sessions
Alert on HTTP 200 responses to Internal Operations URLs when the requesting user's assigned responsibilities do not include General Ledger access

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized SIEM for cross-source correlation
Monitor for spikes in General Ledger data extraction (report exports, XML/CSV downloads) by account and source IP
Track failed authorization events and role escalation attempts within the FND (Foundation) security tables

How to Mitigate CVE-2026-70764

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update Advisory, August 2026 to all affected E-Business Suite 12.2.3–12.2.15 instances
Audit and reduce the number of low-privileged accounts with network reachability to General Ledger HTTP endpoints
Review General Ledger responsibility assignments and remove any that are not required for business function

Patch Information

Oracle addressed CVE-2026-70764 in the August 2026 Critical Patch Update. Administrators should reference the Oracle Security Alert for the specific patch identifiers applicable to each E-Business Suite 12.2.x release and follow Oracle's documented patching order for the E-Business Suite technology stack.

Workarounds

Restrict network access to E-Business Suite HTTP endpoints via reverse proxy, WAF rules, or network segmentation until patches are applied
Enforce multi-factor authentication on all E-Business Suite accounts to raise the cost of credential-based access
Disable or lock unused user accounts and rotate credentials for shared or service accounts with General Ledger reachability

bash

# Example: restrict Oracle E-Business Suite HTTP access at the reverse proxy
# to trusted internal subnets until the August 2026 CPU patch is applied
location /OA_HTML/ {
    allow 10.20.30.0/24;   # finance operations subnet
    allow 10.20.40.0/24;   # EBS administrators
    deny  all;
    proxy_pass http://ebs-backend;
}