CVE-2026-70777: Oracle iSupplier Portal Auth Bypass Flaw

CVE-2026-70777 Overview

CVE-2026-70777 is a high-severity vulnerability in the Oracle iSupplier Portal component of Oracle E-Business Suite. The flaw resides in the Internal Operations subcomponent and affects supported versions 12.2.3 through 12.2.15. An unauthenticated remote attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all data accessible through Oracle iSupplier Portal. Oracle published the fix in its August 2026 Critical Security Patch Update advisory.

Critical Impact
Unauthenticated remote attackers can extract sensitive supplier and business data from Oracle iSupplier Portal over HTTP without user interaction.

Affected Products

Oracle E-Business Suite — Oracle iSupplier Portal 12.2.3
Oracle E-Business Suite — Oracle iSupplier Portal versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle iSupplier Portal 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70777 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70777

Vulnerability Analysis

The vulnerability affects the Internal Operations component of Oracle iSupplier Portal, part of Oracle E-Business Suite. Attackers reach the flaw over HTTP without credentials and without user interaction. The impact is scoped to confidentiality: successful exploitation exposes data that the iSupplier Portal handles, including supplier records and business operations data. Oracle rates the flaw at 7.5 on the CVSS 3.1 base scale, reflecting a network-accessible information disclosure with no integrity or availability impact. The EPSS score is 0.316% (24.5 percentile) as of 2026-08-20, indicating low current exploitation probability.

Root Cause

Oracle's advisory categorizes the issue as an information disclosure defect in the Internal Operations subcomponent. Oracle has not published root-cause details. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a missing authorization or authentication control on an HTTP endpoint that exposes sensitive data. See the Oracle Security Alert for vendor-supplied details.

Attack Vector

An unauthenticated attacker with network reach to the iSupplier Portal HTTP interface can send crafted requests that return protected data. No privileges, user interaction, or foothold in the target environment are required. Internet-exposed iSupplier deployments face the highest exposure, but internal attackers on segmented networks with routing to the portal can also exploit the flaw.

No verified proof-of-concept code has been published. Refer to the Oracle Security Alert for technical details available to Oracle customers.

Detection Methods for CVE-2026-70777

Indicators of Compromise

Unexpected HTTP requests to Oracle iSupplier Portal endpoints from unauthenticated or unknown source IP addresses.
Anomalous response sizes on iSupplier Portal URLs indicating bulk data retrieval.
Access log entries showing sequential or automated enumeration of iSupplier Internal Operations resources.

Detection Strategies

Review Oracle E-Business Suite HTTP access logs for requests to iSupplier Portal paths that return data without a valid authenticated session.
Baseline normal iSupplier Portal traffic patterns and alert on deviations in request volume, source diversity, or response size.
Deploy web application firewall (WAF) rules to log and inspect unauthenticated HTTP traffic to iSupplier endpoints.

Monitoring Recommendations

Forward Oracle HTTP Server and iSupplier application logs to a centralized SIEM for correlation and retention.
Monitor outbound data volumes from Oracle E-Business Suite hosts to identify potential data staging.
Track authentication and session establishment metrics for iSupplier Portal to identify requests that bypass login flows.

How to Mitigate CVE-2026-70777

Immediate Actions Required

Apply the fixes referenced in Oracle's August 2026 Critical Security Patch Update to all Oracle iSupplier Portal deployments running versions 12.2.3 through 12.2.15.
Inventory internet-exposed Oracle E-Business Suite hosts and prioritize patching for any iSupplier Portal instances reachable from untrusted networks.
Review HTTP access logs for the iSupplier Portal for signs of prior exploitation before applying the patch.

Patch Information

Oracle addressed CVE-2026-70777 in the August 2026 Critical Security Patch Update. Administrators should download and apply the relevant patches for Oracle E-Business Suite 12.2.3 through 12.2.15 as documented in the Oracle Security Alert. Oracle's My Oracle Support portal provides the specific patch bundles per release.

Workarounds

Restrict network access to the iSupplier Portal to trusted supplier networks using firewall or reverse-proxy allowlists until patches are deployed.
Place the iSupplier Portal behind a WAF configured to block unauthenticated requests to Internal Operations endpoints.
Enforce VPN or zero-trust network access requirements for external supplier connectivity where feasible.

bash

# Example: restrict iSupplier Portal HTTP access at the reverse proxy
# Replace <trusted_supplier_cidr> with approved supplier network ranges
location /OA_HTML/ {
    allow <trusted_supplier_cidr>;
    deny all;
    proxy_pass http://ebs-backend;
}