CVE-2026-70775: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-70775 Overview

CVE-2026-70775 is an access control vulnerability [CWE-284] in the Oracle Installed Base product of Oracle E-Business Suite. The flaw resides in the User Interface component and affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Installed Base. Successful exploitation results in unauthorized update, insert, or delete access to some accessible data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service.

Critical Impact
Authenticated network attackers can modify and read a subset of Oracle Installed Base data and trigger partial denial of service against the application.

Affected Products

Oracle E-Business Suite - Oracle Installed Base 12.2.3
Oracle E-Business Suite - Oracle Installed Base versions 12.2.4 through 12.2.14
Oracle E-Business Suite - Oracle Installed Base 12.2.15

Discovery Timeline

2026-08-18 - CVE CVE-2026-70775 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70775

Vulnerability Analysis

The vulnerability is classified under CWE-284 (Improper Access Control) in the User Interface component of Oracle Installed Base. Oracle Installed Base tracks customer-owned assets and product instances across the E-Business Suite. The flaw allows an authenticated attacker holding low-level privileges to interact with functionality or data that should be restricted. The impact spans confidentiality, integrity, and availability, though each dimension is limited in scope. Attackers do not need user interaction, and the attack complexity is low, making exploitation practical for anyone with valid low-tier E-Business Suite credentials.

Root Cause

The root cause is improper enforcement of access controls within the Oracle Installed Base User Interface. The application fails to consistently validate that the authenticated user is authorized to perform requested operations against specific resources. This gap enables unauthorized create, read, update, and delete actions on a subset of Installed Base data.

Attack Vector

Exploitation occurs over the network using HTTP against the Oracle E-Business Suite web interface. The attacker must authenticate to the application with low privileges before invoking the vulnerable functionality. Once authenticated, the attacker issues crafted HTTP requests to the Installed Base user interface endpoints to trigger the unauthorized data operations or partial denial of service condition. No user interaction from other victims is required, and the scope remains unchanged, meaning the impact is contained to Oracle Installed Base.

No public proof-of-concept exploit or exploitation code is available for CVE-2026-70775 at this time. See the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-70775

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle Installed Base records performed by low-privileged user accounts
Anomalous HTTP request patterns targeting Installed Base User Interface endpoints from a single authenticated session
Application-level errors or slowdowns in the Installed Base module consistent with partial denial of service conditions

Detection Strategies

Enable Oracle E-Business Suite auditing on Installed Base tables to capture insert, update, and delete operations by user and timestamp
Correlate application server access logs with database audit trails to identify low-privileged users performing data modifications outside their role scope
Baseline normal request volumes to Installed Base UI endpoints and alert on statistically significant deviations

Monitoring Recommendations

Forward Oracle E-Business Suite application, middleware, and database audit logs to a centralized SIEM for correlation and long-term retention
Monitor for authentication events from accounts that suddenly access Installed Base functions inconsistent with their historical usage
Track HTTP 4xx and 5xx response spikes on Installed Base endpoints that may indicate exploitation attempts or partial DoS conditions

How to Mitigate CVE-2026-70775

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert as soon as change windows permit
Inventory all Oracle E-Business Suite deployments running Oracle Installed Base versions 12.2.3 through 12.2.15 and prioritize patching
Review Installed Base user role assignments and remove unnecessary access from low-privileged accounts

Patch Information

Oracle addresses this vulnerability in the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the specific patch identifiers applicable to each supported Oracle E-Business Suite 12.2.x release and apply them following Oracle's documented patching procedures.

Workarounds

Restrict network access to Oracle E-Business Suite interfaces through network segmentation, VPN, or reverse proxy access controls while patching is scheduled
Reduce the number of accounts with any level of access to Oracle Installed Base functionality until the patch is applied
Enable enhanced logging on Installed Base UI endpoints to increase detection coverage during the exposure window