CVE-2026-70805: Oracle E-Business Suite Auth Bypass Flaw

CVE-2026-70805 Overview

CVE-2026-70805 is a high-severity vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite, specifically within the Change Management component. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this issue to compromise the application. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible to Oracle Project Planning and Control. The vulnerability was published to the National Vulnerability Database (NVD) on August 18, 2026, and referenced in the Oracle Critical Patch Update advisory.

Critical Impact
Authenticated attackers can remotely read and modify all Oracle Project Planning and Control data via HTTP, compromising confidentiality and integrity of project financial and change management records.

Affected Products

Oracle E-Business Suite — Oracle Project Planning and Control 12.2.3
Oracle E-Business Suite — Oracle Project Planning and Control versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Project Planning and Control 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70805 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70805

Vulnerability Analysis

The vulnerability resides in the Change Management component of Oracle Project Planning and Control, a module within Oracle E-Business Suite used to manage project change requests, change orders, and control workflows. An attacker only needs an authenticated low-privileged account and network access over HTTP to exploit it. No user interaction is required, and the attack complexity is low, making the vulnerability practical to exploit in production environments where E-Business Suite is exposed to internal or partner networks.

Successful exploitation grants the attacker unauthorized access to all data accessible to Oracle Project Planning and Control, along with the ability to create, delete, or modify that data. This directly threatens the integrity of project financials, change control records, and downstream reporting. Availability is not impacted, but the scope of confidentiality and integrity loss covers the full data set exposed through the affected module.

Root Cause

Oracle has not published detailed root cause information in the NVD entry. The advisory characterizes the flaw as an authorization or access control weakness in the Change Management component that permits a low-privileged user to perform operations beyond their intended entitlements. Consult the Oracle Security Alert for vendor-provided technical context.

Attack Vector

The attack vector is network-based over HTTP against the Oracle E-Business Suite web tier. The attacker must hold valid credentials with low privileges on the target instance. Once authenticated, the attacker issues crafted HTTP requests to the Change Management functionality of Oracle Project Planning and Control to trigger unauthorized read and write operations against protected data.

No public proof-of-concept exploit or exploitation activity has been reported at the time of publication. The EPSS score is 0.365%, indicating a low probability of exploitation activity in the near term, though this can change as details emerge.

Detection Methods for CVE-2026-70805

Indicators of Compromise

Unexpected HTTP requests from low-privileged user accounts to Oracle E-Business Suite endpoints associated with the Project Planning and Control Change Management module.
Unauthorized creation, modification, or deletion events in Change Management audit tables for records outside the user's normal project scope.
Anomalous session activity for accounts that do not typically interact with project change workflows.

Detection Strategies

Enable and review Oracle E-Business Suite Sign-On Audit and Page Access Tracking to identify low-privileged accounts accessing Change Management URLs.
Compare application-level audit logs against role assignments to identify users performing operations that exceed their responsibilities.
Alert on bulk data change patterns in Project Planning and Control tables originating from a single session.

Monitoring Recommendations

Forward Oracle E-Business Suite application, Apache/OHS access, and database audit logs to a centralized analytics platform for cross-source correlation.
Baseline normal HTTP request patterns for the Change Management module and alert on statistically significant deviations by user or source IP.
Monitor privileged database operations against PA_* project accounting schema objects performed via application service accounts.

How to Mitigate CVE-2026-70805

Immediate Actions Required

Apply the Oracle Critical Patch Update fixes referenced in the Oracle Security Alert to all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15.
Inventory all Oracle Project Planning and Control deployments and prioritize internet-facing or partner-accessible instances for immediate patching.
Review Change Management audit logs from the vulnerability disclosure window for signs of unauthorized activity.

Patch Information

Oracle released fixes as part of the August 2026 Critical Patch Update. Administrators should reference the Oracle Security Alert for the specific patch identifiers applicable to Oracle E-Business Suite versions 12.2.3 through 12.2.15 and apply them following Oracle's documented patching procedures.

Workarounds

Restrict network access to the Oracle E-Business Suite web tier so that only trusted corporate networks and authorized users can reach Project Planning and Control endpoints.
Enforce least-privilege responsibility assignments and remove Change Management access from users who do not require it.
Require multi-factor authentication for all Oracle E-Business Suite user accounts to raise the cost of credential compromise.

bash

# Configuration example: restrict access to the Oracle E-Business Suite
# Project Planning and Control Change Management endpoints at the reverse
# proxy or WAF layer until patches are applied.

# Example nginx snippet - allow only trusted subnets to reach the module
location ~* /OA_HTML/.*(PAXCCMUI|ChangeManagement) {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://ebs_backend;
}