Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
CVE Vulnerability Database
Vulnerability Database/CVE-2026-70802

CVE-2026-70802: Oracle E-Business Suite Privilege Escalation

CVE-2026-70802 is a privilege escalation vulnerability in Oracle Public Sector Human Resources that can lead to complete system takeover. This article covers the technical details, affected versions, and mitigation strategies.

Published:

CVE-2026-70802 Overview

CVE-2026-70802 affects the Oracle Public Sector Human Resources product within Oracle E-Business Suite (EBS), specifically the Regression Testing component. Supported versions 12.2.3 through 12.2.15 are affected. The flaw allows a high-privileged attacker with network access via HTTP to compromise Oracle Public Sector Human Resources. Although difficult to exploit, a successful attack results in complete takeover of the target and produces a scope change that impacts additional Oracle products. Oracle disclosed the issue in its August 2026 security alert cycle.

Critical Impact

Successful exploitation results in takeover of Oracle Public Sector Human Resources and cascades to additional Oracle E-Business Suite components through scope change, affecting confidentiality, integrity, and availability.

Affected Products

  • Oracle E-Business Suite – Oracle Public Sector Human Resources 12.2.3
  • Oracle E-Business Suite – Oracle Public Sector Human Resources versions 12.2.4 through 12.2.14
  • Oracle E-Business Suite – Oracle Public Sector Human Resources 12.2.15

Discovery Timeline

  • 2026-08-18 - CVE-2026-70802 published to NVD
  • 2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70802

Vulnerability Analysis

The vulnerability resides in the Regression Testing component of Oracle Public Sector Human Resources. An authenticated attacker holding high privileges can send crafted HTTP traffic to the affected module and take over the product. The attack requires no user interaction but is rated as high complexity, meaning the attacker must satisfy non-trivial preconditions to succeed.

Oracle notes a scope change, which indicates the exploited component can affect resources beyond its own security authority. In practice, an attacker who compromises the Regression Testing surface in Public Sector Human Resources can pivot into other Oracle E-Business Suite modules that share trust boundaries. Confidentiality, integrity, and availability are all impacted at the high level.

The issue is tracked with an EPSS probability of 0.386% (percentile 32.01), indicating a low near-term likelihood of observed exploitation. No public proof-of-concept, exploit code, or CISA KEV listing exists at the time of publication.

Root Cause

Oracle has not published detailed root cause information in the public advisory. Based on Oracle's CVSS metrics, the defect is reachable through the HTTP interface exposed by the Regression Testing component and is gated by authentication requiring elevated privileges. The scope change indicates that trust boundaries between the vulnerable component and other Oracle E-Business Suite services are not enforced adequately after exploitation.

Attack Vector

The attack vector is network-based over HTTP. An attacker must first hold high-privileged credentials within Oracle E-Business Suite before targeting the Regression Testing component of Oracle Public Sector Human Resources. Once authenticated, the attacker submits crafted requests to the affected component. No user interaction is required. Successful exploitation results in full takeover of the target and produces impact on additional Oracle products connected within the EBS trust boundary.

See the Oracle Security Alert for the vendor's technical guidance.

Detection Methods for CVE-2026-70802

Indicators of Compromise

  • Unexpected HTTP requests to Regression Testing endpoints within Oracle Public Sector Human Resources from accounts that do not normally exercise that component.
  • Authenticated sessions from privileged EBS accounts originating from atypical source addresses, hours, or user agents.
  • New or modified administrative objects, workflows, or scheduled jobs in Oracle Public Sector Human Resources following privileged HTTP activity.

Detection Strategies

  • Correlate Oracle E-Business Suite application audit logs with web server access logs to identify privileged HTTP calls to Regression Testing URIs.
  • Baseline normal Regression Testing usage per privileged user and alert on deviations in frequency, endpoint, or payload structure.
  • Monitor for lateral movement signals across EBS modules that follow suspicious activity in Public Sector Human Resources, which would be consistent with the CVSS scope change.

Monitoring Recommendations

  • Forward Oracle E-Business Suite application, database, and HTTP tier logs to a centralized analytics platform for retention and correlation.
  • Track authentication events for accounts with high privileges in Public Sector Human Resources and alert on privilege changes or new grants.
  • Review Oracle's August 2026 Security Alert advisory periodically for updated patch and detection guidance.

How to Mitigate CVE-2026-70802

Immediate Actions Required

  • Apply the fix referenced in the Oracle August 2026 Critical Security Patch Update to any Oracle E-Business Suite deployment running Public Sector Human Resources 12.2.3 through 12.2.15.
  • Inventory all EBS environments, including non-production and disaster recovery, to confirm patch coverage.
  • Rotate credentials for privileged EBS accounts and validate that high-privilege access is limited to required personnel.

Patch Information

Oracle addressed CVE-2026-70802 in the August 2026 Critical Security Patch Update. Administrators should download and apply the relevant patch for Oracle E-Business Suite version 12.2.x per the Oracle Security Alert. Oracle recommends applying Critical Patch Updates as they are released and does not provide long-term workarounds in lieu of patching.

Workarounds

  • Restrict network reachability to the Oracle E-Business Suite HTTP tier so that only trusted internal networks and jump hosts can reach the Regression Testing component.
  • Enforce multi-factor authentication and least-privilege role assignments for accounts capable of accessing Public Sector Human Resources administrative functions.
  • If patching must be delayed, temporarily disable or restrict access to Regression Testing functionality where operationally feasible.
bash
# Example: restrict access to the EBS HTTP tier at the network layer
# Replace 10.0.0.0/24 with your trusted administrative subnet
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Default Legacy - Prefooter | Experience the World’s Most Advanced Cybersecurity Platform

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne