CVE-2026-70799: Oracle SDP Information Disclosure Flaw

CVE-2026-70799 Overview

CVE-2026-70799 is a high-severity information disclosure vulnerability in the Oracle SDP Number Portability product, a component of Oracle E-Business Suite. The flaw resides in the Internal Operations component and affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation grants unauthorized access to critical data or complete access to all data accessible through Oracle SDP Number Portability. Oracle disclosed the issue in its August 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can extract sensitive data from Oracle SDP Number Portability instances over the network, leading to full confidentiality compromise of the application's data.

Affected Products

Oracle E-Business Suite — Oracle SDP Number Portability 12.2.3
Oracle E-Business Suite — Oracle SDP Number Portability 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle SDP Number Portability 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70799 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70799

Vulnerability Analysis

CVE-2026-70799 affects the Internal Operations component of Oracle SDP Number Portability within Oracle E-Business Suite. The flaw is remotely exploitable over HTTP without authentication or user interaction. The impact is scoped to confidentiality: the integrity and availability of the target system are not affected. However, an attacker can obtain unauthorized access to critical data or all data accessible through the affected module. Because Oracle SDP Number Portability handles telecommunications provisioning workflows, exposed data can include subscriber identifiers, routing information, and internal operational records.

Root Cause

Oracle has not published detailed root cause analysis for CVE-2026-70799. Oracle's Critical Patch Update advisories typically withhold technical specifics to reduce the risk of weaponization prior to patch adoption. The CVSS vector indicates that no privileges and no user interaction are required, and the scope is unchanged. This pattern is consistent with a missing authorization or improper access control weakness in an HTTP-facing endpoint exposed by the Internal Operations component.

Attack Vector

The attack vector is the network. An unauthenticated remote attacker sends crafted HTTP requests to a reachable Oracle E-Business Suite instance running a vulnerable version of Oracle SDP Number Portability. The attack complexity is low, meaning no special conditions or timing are needed. Instances exposed to the internet or accessible from untrusted network segments are at highest risk. See the Oracle Security Alert for the official advisory covering this issue.

Detection Methods for CVE-2026-70799

Indicators of Compromise

Unexpected HTTP requests to Oracle SDP Number Portability endpoints from unauthenticated or external sources.
Anomalous outbound data volumes from Oracle E-Business Suite application servers.
Access log entries showing bulk data retrieval from Internal Operations URIs without prior authenticated session activity.

Detection Strategies

Inventory all Oracle E-Business Suite deployments and confirm which run Oracle SDP Number Portability versions 12.2.3 through 12.2.15.
Deploy web application firewall rules that flag unauthenticated HTTP requests targeting SDP Number Portability paths.
Correlate application server access logs with authentication events to identify request sequences that bypass login flows.

Monitoring Recommendations

Enable verbose HTTP access logging on Oracle HTTP Server fronting E-Business Suite and forward logs to a centralized analytics platform.
Baseline typical request volumes to Internal Operations endpoints and alert on statistical deviations.
Monitor for scanning behavior across ranges of Oracle E-Business Suite URLs commonly probed by opportunistic attackers after Critical Patch Updates.

How to Mitigate CVE-2026-70799

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all Oracle E-Business Suite environments running Oracle SDP Number Portability 12.2.3 through 12.2.15.
Restrict network exposure of Oracle E-Business Suite HTTP endpoints to trusted networks and authenticated users only.
Review access logs since the patch release date for signs of exploitation attempts against SDP Number Portability endpoints.

Patch Information

Oracle addressed CVE-2026-70799 in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert and apply the patches corresponding to their deployed Oracle E-Business Suite release. Oracle recommends staying on actively supported versions and applying Critical Patch Updates as they are released.

Workarounds

Place vulnerable Oracle E-Business Suite instances behind a reverse proxy or WAF that enforces authentication before requests reach the application tier.
Disable or block network access to the Oracle SDP Number Portability module if it is not in active use within the deployment.
Segment Oracle E-Business Suite servers on isolated network zones and restrict inbound HTTP access with strict firewall allow-lists.

bash

# Configuration example: restrict HTTP access to trusted subnets using iptables
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP