CVE-2026-70806: Oracle E-Business Tax DOS Vulnerability

CVE-2026-70806 Overview

CVE-2026-70806 is a high-severity vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite, specifically within the Internal Operations component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with logon access to the infrastructure where Oracle E-Business Tax executes can exploit this flaw to compromise the application. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and can cause a hang or repeatable crash resulting in a complete denial of service.

Critical Impact
A low-privileged local attacker can modify or destroy all Oracle E-Business Tax data and trigger a complete denial of service of the application.

Affected Products

Oracle E-Business Suite — E-Business Tax 12.2.3 through 12.2.15
Component: Internal Operations
Deployments running on affected Oracle E-Business Suite infrastructure

Discovery Timeline

2026-08-18 - CVE-2026-70806 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
2026-08-18 - Oracle Security Alert CSPUAUG2026 referenced as advisory source

Technical Details for CVE-2026-70806

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle E-Business Tax. Oracle classifies exploitation as easily achievable by an attacker who already holds low-privileged logon access to the infrastructure hosting the application. Exploitation does not require user interaction and does not cross a security boundary, keeping the scope unchanged.

The impact profile targets integrity and availability but not confidentiality. An attacker can perform unauthorized create, delete, or modify operations across all data accessible to Oracle E-Business Tax. The same access allows the attacker to hang the service or induce a repeatable crash, yielding a complete denial of service of the tax product.

Because Oracle E-Business Tax processes financial and jurisdictional tax data, integrity loss can propagate to downstream financial reporting, invoicing, and compliance workflows within Oracle E-Business Suite. The EPSS probability at publication is 0.138% (percentile 3.701), reflecting no observed in-the-wild exploitation to date.

Root Cause

Oracle has not published root-cause detail beyond the component identification. The advisory attributes the flaw to logic within the Internal Operations component that grants a low-privileged authenticated user the ability to write, delete, or destabilize data outside their intended authorization boundary. This pattern is consistent with a broken access control or improper authorization weakness.

Attack Vector

The attack vector is local. The attacker must first obtain logon access to the infrastructure where Oracle E-Business Tax executes. Once authenticated, the attacker interacts with the Internal Operations component to trigger integrity or availability impact. No end-user interaction is required, and the attack complexity is low. See the Oracle Security Alert CSPUAUG2026 for vendor guidance.

No verified exploitation code is publicly available. The vulnerability mechanism is documented in prose only; refer to the Oracle advisory for authoritative technical details.

Detection Methods for CVE-2026-70806

Indicators of Compromise

Unexpected create, update, or delete operations against Oracle E-Business Tax tables performed by low-privileged application or OS accounts
Abrupt service hangs or repeated crashes of Oracle E-Business Tax processes without corresponding administrative activity
Anomalous logon sessions to the Oracle E-Business Suite infrastructure from accounts that do not typically administer tax workloads

Detection Strategies

Audit Oracle E-Business Suite FND_LOG and database audit trails for privileged operations originating from low-privileged accounts
Correlate operating system logon events on the E-Business Suite host with subsequent Internal Operations activity in application logs
Baseline normal Oracle E-Business Tax data-modification rates and alert on deviations that suggest bulk tampering

Monitoring Recommendations

Forward Oracle E-Business Suite application, database, and host operating system logs to a centralized analytics platform for correlation
Enable Oracle database fine-grained auditing on tax-related schemas to capture unauthorized DML activity
Monitor process health and restart frequency of Oracle E-Business Tax services to detect denial-of-service attempts early

How to Mitigate CVE-2026-70806

Immediate Actions Required

Apply the fixes published in Oracle Security Alert CSPUAUG2026 to all Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15
Inventory local accounts with logon access to the Oracle E-Business Suite infrastructure and revoke any that are not operationally required
Rotate credentials for any accounts suspected of unauthorized use on affected hosts

Patch Information

Oracle addresses CVE-2026-70806 in the out-of-cycle security alert CSPUAUG2026. Administrators should review the Oracle Security Alert CSPUAUG2026 for the specific patch identifiers, prerequisites, and application order for their Oracle E-Business Suite version.

Workarounds

Restrict logon access to Oracle E-Business Suite hosts to a minimal set of administrators using operating system access controls
Enforce network segmentation so that only authorized management jump hosts can reach the E-Business Suite infrastructure
Enable enhanced database and application auditing on tax-related components until the vendor patch is applied

bash

# Configuration example: refer to Oracle Security Alert CSPUAUG2026
# for authoritative patch application steps for Oracle E-Business Suite 12.2.x