CVE-2026-70801: Oracle Flow Manufacturing Data Disclosure

CVE-2026-70801 Overview

CVE-2026-70801 is a vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite, within the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the issue to compromise Oracle Flow Manufacturing. Successful exploitation results in unauthorized access to all Oracle Flow Manufacturing accessible data and partial unauthorized update, insert, or delete access. Oracle documented the issue in its August 2026 Critical Patch Update advisory.

Critical Impact
Authenticated attackers over HTTP can obtain complete read access to Oracle Flow Manufacturing data and modify a subset of records, exposing manufacturing operations and integrity of production data.

Affected Products

Oracle E-Business Suite — Oracle Flow Manufacturing 12.2.3
Oracle E-Business Suite — Oracle Flow Manufacturing versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Flow Manufacturing 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70801 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70801

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Flow Manufacturing, a module of the Oracle E-Business Suite used for manufacturing planning and execution. The flaw is reachable over HTTP and requires only low-level authentication to trigger.

Exploitation yields high confidentiality impact and low integrity impact, with no direct availability impact. Attackers can read all data accessible to the Flow Manufacturing module and modify a subset of that data, which can undermine the trustworthiness of production records.

The EPSS score for this CVE is 0.24%, placing it in the 15.455 percentile of exploitation likelihood at the time of publication. No public proof-of-concept exploit is currently available.

Root Cause

Oracle has not published a detailed technical root cause in the advisory. Based on the CVSS profile and attack surface, the flaw is exposed through an HTTP-accessible interface within Internal Operations that fails to properly enforce access control on read and write operations for authenticated users. Refer to the Oracle Security Alert for authoritative vendor detail.

Attack Vector

The attack vector is network-based over HTTP. A remote attacker holding valid, low-privileged credentials to the Oracle E-Business Suite environment can issue crafted HTTP requests to the affected Flow Manufacturing endpoints. No user interaction is required, and exploitation complexity is low. The impact is confined to the Flow Manufacturing scope and does not cross to other components.

No verified public exploit code is available. See the Oracle Security Alert for the vendor's technical description.

Detection Methods for CVE-2026-70801

Indicators of Compromise

Anomalous HTTP requests to Oracle Flow Manufacturing Internal Operations endpoints originating from low-privileged user sessions.
Unexpected bulk read operations against Flow Manufacturing tables or reports by non-administrative accounts.
Unauthorized INSERT, UPDATE, or DELETE activity on Flow Manufacturing records outside of scheduled batch windows.

Detection Strategies

Correlate Oracle E-Business Suite application audit logs with database audit trails to identify low-privileged accounts accessing sensitive Flow Manufacturing data.
Baseline normal API and page access patterns for Flow Manufacturing users and alert on statistical deviations.
Monitor web application firewall (WAF) telemetry for repeated authenticated requests to Internal Operations URLs from a single session.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking for the Flow Manufacturing responsibility set.
Forward E-Business Suite application, middleware, and database logs to a centralized SIEM for correlation and long-term retention.
Review privileged and low-privileged role assignments for Flow Manufacturing on a recurring basis to reduce the pool of accounts that could exploit this flaw.

How to Mitigate CVE-2026-70801

Immediate Actions Required

Apply the fixes provided in the Oracle August 2026 Critical Patch Update advisory to all Oracle E-Business Suite deployments running Flow Manufacturing 12.2.3 through 12.2.15.
Inventory all accounts with access to the Flow Manufacturing responsibility and remove entitlements that are not required.
Restrict network reachability of the E-Business Suite HTTP endpoints to trusted corporate networks and VPN ranges.

Patch Information

Oracle addressed CVE-2026-70801 in the August 2026 Critical Patch Update for Oracle E-Business Suite. Administrators should review the Oracle Security Alert for patch numbers, prerequisite steps, and post-installation validation instructions specific to each supported release from 12.2.3 to 12.2.15.

Workarounds

No vendor-supplied workarounds are documented; apply the patch as the primary remediation.
As a compensating control, place the E-Business Suite front-end behind a reverse proxy or WAF that restricts access to Flow Manufacturing URLs to authorized users and networks.
Enforce strong authentication, session timeouts, and least-privilege role design for all E-Business Suite users until patching is complete.

bash

# Example: restrict access to Flow Manufacturing paths at the reverse proxy
# (adapt paths to your deployment before enforcement)
location ~* /OA_HTML/.*FlowManufacturing.* {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://ebs_backend;
}