CVE-2026-70786: Oracle Fulfillment Manager Info Leak Flaw

CVE-2026-70786 Overview

CVE-2026-70786 affects the Fulfillment Engine component of Oracle Service Fulfillment Manager within Oracle E-Business Suite. Supported versions 12.2.3 through 12.2.15 are vulnerable. An authenticated attacker with low privileges and network access via HTTP can exploit the flaw. Successful exploitation requires user interaction from a victim other than the attacker.

The vulnerability produces a scope change, meaning attacks can impact resources beyond Oracle Service Fulfillment Manager. Attackers can gain unauthorized read access to all data accessible by the product and unauthorized update, insert, or delete access to a subset of that data.

Critical Impact
A low-privileged attacker can trick an authenticated user into a request that exposes all data accessible to Oracle Service Fulfillment Manager and modifies a portion of it, with impact crossing the security scope boundary.

Affected Products

Oracle E-Business Suite — Oracle Service Fulfillment Manager 12.2.3
Oracle E-Business Suite — Oracle Service Fulfillment Manager versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Service Fulfillment Manager 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70786 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70786

Vulnerability Analysis

The flaw resides in the Fulfillment Engine component of Oracle Service Fulfillment Manager. The engine processes fulfillment workflow requests over HTTP and is reachable by users holding low-level application privileges. The vulnerability requires human interaction from a user other than the attacker, which is characteristic of client-side triggered issues such as cross-site scripting or forged request patterns.

Because the CVSS scope is marked as changed, exploitation impacts data and functionality outside the security authority of the vulnerable component. Confidentiality impact is high because all data accessible to Oracle Service Fulfillment Manager can be exposed. Integrity impact is limited to a subset of writable records, and availability is not affected.

Oracle E-Business Suite deployments commonly integrate Service Fulfillment Manager with order management, provisioning, and billing modules. A scope-changing compromise can therefore expose related transactional data across the suite.

Root Cause

Oracle has not published root-cause detail for CVE-2026-70786. The CVSS metrics indicate a network-accessible HTTP interface within the Fulfillment Engine that fails to enforce sufficient controls when an authenticated victim interacts with attacker-supplied content. Full technical details are held in Oracle's advisory, distributed under its coordinated disclosure program.

Attack Vector

The attacker authenticates to Oracle E-Business Suite with low privileges. The attacker then crafts input or a link that, when actioned by a second authenticated user, triggers the vulnerable code path in the Fulfillment Engine. The victim's session context is used to read data across all Service Fulfillment Manager records and to modify a subset of them, with downstream effects on integrated products.

Refer to the Oracle Security Alert for vendor-provided technical detail.

Detection Methods for CVE-2026-70786

Indicators of Compromise

Unexpected HTTP requests to Fulfillment Engine endpoints (OKL, XDP, and related Service Fulfillment Manager URIs) originating from low-privileged accounts.
Session records showing one user submitting content that is later actioned within another user's authenticated session.
Audit log entries showing bulk read operations against Service Fulfillment Manager tables followed by targeted updates to related records.

Detection Strategies

Enable Oracle E-Business Suite Sign-On audit and Page Access Tracking, then baseline Fulfillment Engine access patterns per role.
Alert on Service Fulfillment Manager transactions initiated shortly after an inbound link click or workflow notification action.
Correlate database audit logs from APPS schema tables associated with SFM against the initiating application user.

Monitoring Recommendations

Forward Oracle E-Business Suite application, workflow, and database audit logs to a centralized analytics platform for cross-source correlation.
Monitor for privilege combinations where a low-privileged responsibility submits data consumed by higher-privileged fulfillment operators.
Track outbound data volumes from Service Fulfillment Manager endpoints to detect bulk exfiltration triggered through a victim's session.

How to Mitigate CVE-2026-70786

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update / Security Alert for August 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 installations.
Inventory all Service Fulfillment Manager responsibilities and remove access from accounts that do not require the module.
Review workflow notifications and inbound content sources that feed Fulfillment Engine actions and validate their trust boundaries.

Patch Information

Oracle addressed CVE-2026-70786 through the August 2026 Critical Patch Update / Security Alert cycle. Consult the Oracle Security Alert for the specific patch identifiers applicable to each 12.2.x release. Apply patches in a non-production environment first and validate custom extensions to Service Fulfillment Manager before promotion.

Workarounds

Restrict network access to Oracle E-Business Suite Fulfillment Engine URLs to trusted internal segments using a reverse proxy or WAF policy.
Suspend or restrict low-privileged responsibilities that can submit content processed by higher-privileged users within the Fulfillment Engine.
Enforce browser-side controls such as strict Content Security Policy headers on the Oracle E-Business Suite front end to reduce user-interaction exploitation paths.

bash

# Example: restrict Fulfillment Engine paths at the reverse proxy
location ~* /OA_HTML/.*(OKL|XDP|SFM) {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://ebs_backend;
}