CVE-2026-70804: Oracle E-Business Suite Privilege Escalation

CVE-2026-70804 Overview

CVE-2026-70804 affects the Oracle Public Sector Human Resources product within Oracle E-Business Suite, specifically the Regression Testing component. Oracle disclosed the issue in Security Alert CSPUAUG 2026. Supported versions 12.2.3 through 12.2.15 are affected.

Exploitation requires a high-privileged attacker with network access over HTTP. Successful attacks can result in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible through Oracle Public Sector Human Resources. The vulnerability carries a scope change, meaning impact extends beyond the vulnerable component.

Critical Impact
Attackers with high privileges can compromise data confidentiality and integrity across Oracle Public Sector Human Resources and additional connected products through scope change.

Affected Products

Oracle E-Business Suite — Oracle Public Sector Human Resources 12.2.3
Oracle E-Business Suite — Oracle Public Sector Human Resources versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Public Sector Human Resources 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70804 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70804

Vulnerability Analysis

The flaw resides in the Regression Testing component of Oracle Public Sector Human Resources. An authenticated user with high privileges can send crafted HTTP requests to the affected module and manipulate data outside the intended trust boundary of the component. Because the vulnerability triggers a scope change, exploitation can affect resources beyond the Public Sector Human Resources product itself.

Successful exploitation grants unauthorized ability to create, modify, or delete records that the Public Sector Human Resources module can access. It also enables full read access to sensitive HR data, including data governed by additional Oracle E-Business Suite components reachable from the compromised context.

Root Cause

Oracle has not published detailed root cause information. Based on the CVSS metrics, the weakness allows a privileged authenticated user to escape the intended authorization scope of the Regression Testing component and act on data belonging to other components. Availability is not impacted, but both confidentiality and integrity are compromised.

Attack Vector

The attack vector is network-based over HTTP. High attack complexity indicates that exploitation depends on specific conditions outside the attacker's direct control. No user interaction is required. The attacker must already hold high privileges within the Oracle E-Business Suite environment before attempting exploitation.

No public proof-of-concept code, exploit modules, or in-the-wild exploitation activity has been reported. Refer to the Oracle Security Alert CSPUAUG 2026 for authoritative technical details.

Detection Methods for CVE-2026-70804

Indicators of Compromise

Unexpected HTTP requests to Oracle E-Business Suite endpoints associated with the Regression Testing component of Public Sector Human Resources.
Unusual create, update, or delete operations on Public Sector Human Resources records performed by administrative or integration accounts.
Cross-module data access patterns where a Public Sector Human Resources session reads or modifies data outside its typical scope.

Detection Strategies

Enable Oracle E-Business Suite auditing on the Public Sector Human Resources schema and Regression Testing endpoints, and review privileged session activity.
Correlate application-layer logs with database audit logs to detect scope-crossing data access initiated by HR application sessions.
Baseline normal administrative HTTP traffic to /OA_HTML/ and related Oracle E-Business Suite paths, and alert on deviations from privileged accounts.

Monitoring Recommendations

Forward Oracle E-Business Suite web tier and database audit logs to a centralized analytics platform for retention and correlation.
Monitor authentication and role-assignment changes for accounts with high privileges in Oracle E-Business Suite.
Track outbound data transfers from Oracle E-Business Suite application servers for signs of bulk HR data exfiltration.

How to Mitigate CVE-2026-70804

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUAUG 2026 to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all accounts holding high privileges within Oracle Public Sector Human Resources and reduce the count to the minimum required.
Restrict network access to Oracle E-Business Suite HTTP endpoints so only authorized administrative networks can reach the Regression Testing component.

Patch Information

Oracle addressed CVE-2026-70804 in Security Alert CSPUAUG 2026. Administrators should review the alert for exact patch identifiers, prerequisites, and post-installation validation steps. Apply the patches through the standard Oracle E-Business Suite patching process and validate that affected versions 12.2.3 through 12.2.15 are updated across all environments.

Workarounds

Enforce network segmentation and require VPN or bastion access before privileged users can reach Oracle E-Business Suite HTTP interfaces.
Disable or restrict access to the Regression Testing component in production tiers where it is not operationally required.
Rotate credentials for high-privileged Oracle E-Business Suite accounts and enforce multi-factor authentication at the perimeter.

bash

# Configuration example: restrict access to EBS HTTP endpoints at the reverse proxy
# (Apache example — adapt to your environment)
<Location "/OA_HTML/">
    Require ip 10.10.20.0/24
    Require ip 10.10.30.0/24
</Location>