CVE-2026-70779: Oracle iSupplier Portal Auth Bypass Flaw

CVE-2026-70779 Overview

CVE-2026-70779 affects the Oracle iSupplier Portal component of Oracle E-Business Suite (EBS), specifically the Internal Operations subcomponent. Supported versions 12.2.3 through 12.2.15 are affected. An unauthenticated attacker with network access over HTTP can compromise the iSupplier Portal without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of data accessible to the iSupplier Portal, along with unauthorized read access to all iSupplier Portal accessible data. Oracle rates the flaw as difficult to exploit but assigns confidentiality and integrity impacts as High.

Critical Impact
Unauthenticated network attackers can read and modify all data accessible to the Oracle iSupplier Portal, exposing supplier records, procurement data, and internal operations content.

Affected Products

Oracle E-Business Suite — Oracle iSupplier Portal 12.2.3
Oracle E-Business Suite — Oracle iSupplier Portal 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle iSupplier Portal 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70779 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70779

Vulnerability Analysis

The flaw resides in the Internal Operations component of Oracle iSupplier Portal, a supplier-facing web application within Oracle E-Business Suite. An attacker sends crafted HTTP requests to the exposed portal endpoints without authenticating. Successful exploitation returns and modifies data that the iSupplier Portal is authorized to access. The impact scope is limited to the iSupplier Portal (Scope: Unchanged), but within that boundary the attacker gains full read and write capability. Availability is not impacted, indicating the vulnerability enables data manipulation rather than denial of service.

Oracle characterizes the attack complexity as High, meaning the attacker must satisfy non-trivial preconditions such as timing, state, or configuration factors before the request succeeds. This complexity does not require authentication or user interaction, however, so internet-exposed iSupplier Portal instances remain reachable to any attacker.

Root Cause

Oracle has not published root-cause details in the public advisory. The vulnerability profile — unauthenticated HTTP access resulting in read and write on portal-accessible data — is consistent with broken access control or missing authorization checks on backend operations exposed by the Internal Operations component. Refer to the Oracle Security Alert for the authoritative advisory.

Attack Vector

Exploitation occurs remotely over HTTP against the iSupplier Portal application. No credentials, tokens, or user interaction are required. Attackers targeting internet-exposed EBS deployments can invoke the vulnerable Internal Operations functionality directly. Because iSupplier Portal is commonly published to external suppliers over the internet, exposure is broader than for purely internal EBS modules.

No public proof-of-concept, exploit code, or exploitation in the wild has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-70779

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to iSupplier Portal endpoints under /OA_HTML/ associated with Internal Operations functionality.
Unexpected supplier, purchase order, or internal operations record creation, modification, or deletion events without a corresponding authenticated user session.
Anomalous request volume or scanning patterns targeting Oracle EBS URLs from single or distributed source addresses.

Detection Strategies

Review Oracle EBS application logs and web-tier access logs for HTTP requests to iSupplier Portal servlets that lack a valid authenticated session identifier.
Correlate database audit records against application session logs to identify data changes with no matching authenticated user context.
Deploy Web Application Firewall (WAF) rules that flag requests to iSupplier Portal endpoints originating from unexpected geographies or non-supplier source ranges.

Monitoring Recommendations

Enable Oracle EBS Sign-On Audit and Page Access Tracking to capture per-request telemetry from the iSupplier Portal.
Forward web-tier, application-tier, and database audit logs to a centralized SIEM for cross-source correlation and long-term retention.
Alert on unauthenticated 200-OK responses from /OA_HTML/ endpoints that normally require authenticated sessions.

How to Mitigate CVE-2026-70779

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory internet-exposed iSupplier Portal instances and prioritize them for immediate patching.
Review web-tier and database audit logs for suspicious activity dating back to the disclosure window.

Patch Information

Oracle addresses CVE-2026-70779 in the Critical Security Patch Update advisory published at Oracle Security Alert cspuaug2026. Administrators should apply the corresponding EBS 12.2 patch bundle for affected iSupplier Portal versions 12.2.3 through 12.2.15. Follow Oracle's standard EBS patching procedure, including AutoConfig and application-tier restart steps.

Workarounds

Restrict network access to the iSupplier Portal using firewall or reverse-proxy allowlists limited to known supplier IP ranges until patching is complete.
Place the iSupplier Portal behind a WAF configured to block anomalous requests to Internal Operations endpoints.
Where the iSupplier Portal is not actively used, disable the responsibility or remove the external URL mapping to eliminate exposure.

bash

# Example: restrict iSupplier Portal exposure at the reverse proxy (Apache httpd)
<Location /OA_HTML/>
    Require ip 203.0.113.0/24
    Require ip 198.51.100.0/24
</Location>