CVE-2026-70796: Oracle General Ledger Privilege Escalation

CVE-2026-70796 Overview

CVE-2026-70796 is a high-severity vulnerability in the Oracle General Ledger product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. Exploitation requires local access to the infrastructure hosting Oracle General Ledger and high privileges, but a successful attack results in a scope change that may impact additional Oracle products beyond General Ledger itself.

Critical Impact
A high-privileged local attacker can achieve unauthorized creation, deletion, or modification of critical Oracle General Ledger data and gain complete read access to all General Ledger accessible data, with impact extending beyond the vulnerable component.

Affected Products

Oracle E-Business Suite — Oracle General Ledger 12.2.3
Oracle E-Business Suite — Oracle General Ledger versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle General Ledger 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70796 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70796

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle General Ledger, a core financial module within Oracle E-Business Suite. Oracle classifies the flaw as difficult to exploit, requiring an authenticated attacker with high privileges and local access to the infrastructure on which General Ledger runs. Despite these prerequisites, the impact is significant because the confidentiality and integrity effects cross a trust boundary. The scope change means an attacker who compromises General Ledger can affect resources managed by other components of the E-Business Suite deployment. Availability is not impacted, but the ability to modify and read financial ledger data introduces material risk to financial reporting and audit integrity.

Root Cause

Oracle has not published detailed technical root-cause information for this issue. Based on the advisory language, the flaw exists in privileged internal operations logic within General Ledger that fails to properly isolate its actions from adjacent components, enabling a scope change under the CVSS 3.1 model. Refer to the Oracle Security Alert for vendor-supplied details.

Attack Vector

The attack vector is local (AV:L). An attacker must first authenticate to the infrastructure hosting Oracle General Ledger with high privileges. From that position, the attacker interacts with the vulnerable Internal Operations logic to read, create, modify, or delete ledger data. The scope change indicates that the affected privileges extend beyond the General Ledger security authority into other resources in the E-Business Suite environment.

No public proof-of-concept code has been released for CVE-2026-70796 and no exploit is currently listed in Exploit-DB or CISA KEV. Refer to the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-70796

Indicators of Compromise

Unexpected creation, modification, or deletion of General Ledger journal entries, balances, or configuration records by privileged accounts outside normal change windows.
Anomalous local logon sessions to Oracle E-Business Suite application or database tier hosts by administrative or service accounts.
Audit trail gaps or disabled FND (Foundation) audit logging on General Ledger tables.

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and database-level auditing for General Ledger schema objects, focusing on tables under the GL schema.
Correlate operating system logon events on E-Business Suite tier hosts with subsequent privileged database or concurrent-manager activity.
Baseline expected activity for internal operations processes and alert on deviations in frequency, source host, or invoking account.

Monitoring Recommendations

Forward E-Business Suite application, concurrent manager, and Oracle database audit logs to a centralized SIEM or data lake for retention and correlation.
Monitor privileged account use on the underlying operating system, including su, sudo, and RDP or SSH sessions to E-Business Suite hosts.
Track changes to General Ledger reference data and financial period status against approved change tickets.

How to Mitigate CVE-2026-70796

Immediate Actions Required

Review the Oracle Security Alert and apply the associated Critical Patch Update to all Oracle E-Business Suite environments running General Ledger 12.2.3 through 12.2.15.
Restrict local and administrative access to E-Business Suite application and database tier hosts to the minimum set of operators required.
Rotate credentials for any privileged accounts that may have been exposed on affected infrastructure.

Patch Information

Oracle addressed CVE-2026-70796 as part of a Security Alert published in August 2026. Administrators should apply the patch bundle referenced in the Oracle Security Alert to Oracle General Ledger versions 12.2.3 through 12.2.15. Follow Oracle's documented patch application procedure for E-Business Suite 12.2, including the required online patching cycle using adop.

Workarounds

Enforce strict segregation of duties so that no single account holds both operating system privileges on E-Business Suite hosts and financial administrative roles in General Ledger.
Require multi-factor authentication and session recording for any interactive logon to E-Business Suite application and database tiers.
Increase audit granularity on General Ledger schema objects and financial period configuration until the patch is applied.

bash

# Example: enable database auditing on core General Ledger tables
sqlplus / as sysdba <<EOF
AUDIT SELECT, INSERT, UPDATE, DELETE ON GL.GL_JE_HEADERS BY ACCESS;
AUDIT SELECT, INSERT, UPDATE, DELETE ON GL.GL_JE_LINES BY ACCESS;
AUDIT SELECT, INSERT, UPDATE, DELETE ON GL.GL_PERIOD_STATUSES BY ACCESS;
EXIT;
EOF