CVE-2026-70810: Oracle Scripting Information Disclosure

CVE-2026-70810 Overview

CVE-2026-70810 is a high-severity information disclosure vulnerability in the Oracle Scripting product of Oracle E-Business Suite, specifically within the Internal Operations component. Affected versions include Oracle E-Business Suite 12.2.3 through 12.2.15. The flaw allows an unauthenticated remote attacker with HTTP network access to compromise Oracle Scripting without user interaction. Successful exploitation results in unauthorized access to critical data or complete disclosure of all data accessible through Oracle Scripting.

Critical Impact
Unauthenticated attackers can retrieve sensitive Oracle Scripting data over the network via HTTP, exposing confidential business information without any prior credentials or user interaction.

Affected Products

Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle Scripting product (Internal Operations component)
Deployments exposing Oracle Scripting endpoints over HTTP

Discovery Timeline

2026-08-18 - CVE-2026-70810 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score recorded at 0.398% (33.2 percentile)

Technical Details for CVE-2026-70810

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Scripting, a module within Oracle E-Business Suite used to build and deploy customer-facing scripts. The flaw enables unauthenticated attackers to reach a network-accessible HTTP endpoint and retrieve confidential data. Only confidentiality is impacted; integrity and availability remain unaffected according to the CVSS vector. Because exploitation requires no authentication and no user interaction, any Oracle E-Business Suite deployment exposing Oracle Scripting to untrusted networks presents immediate risk.

Organizations running Oracle Scripting in versions 12.2.3 through 12.2.15 should treat this as an information disclosure issue that can expose all data reachable through the Scripting component. Full technical details are available in the Oracle Security Alert.

Root Cause

Oracle has not publicly disclosed the underlying code-level defect. Based on the CVSS metrics and vendor description, the root cause is an access control or input handling weakness in an HTTP-exposed Oracle Scripting resource within the Internal Operations component. The endpoint returns sensitive data without validating caller identity or authorization.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to an exposed Oracle Scripting endpoint on an affected Oracle E-Business Suite instance. No credentials, session, or user interaction are required. Successful requests return data that should be restricted to authorized Oracle Scripting users.

No public proof-of-concept exploit is currently documented. See the Oracle Critical Patch Update Advisory for authoritative remediation guidance.

Detection Methods for CVE-2026-70810

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Scripting URLs originating from unexpected external IP addresses.
Large or unusual response payloads returned from Oracle Scripting endpoints to unauthenticated sessions.
Access log entries showing repeated enumeration of Oracle Scripting paths under the Internal Operations component.

Detection Strategies

Review Oracle HTTP Server and reverse-proxy access logs for requests to Oracle Scripting endpoints that lack a valid authenticated session cookie.
Correlate egress traffic volume from the Oracle E-Business Suite tier with source IPs querying Scripting URLs to identify bulk data retrieval.
Deploy web application firewall (WAF) rules that alert on anonymous access attempts to Oracle Scripting resources.

Monitoring Recommendations

Enable verbose auditing on Oracle E-Business Suite middle-tier components and forward logs to a centralized SIEM.
Baseline normal request patterns to Oracle Scripting and alert on deviations, particularly requests without authenticated sessions.
Monitor network flows to the Oracle E-Business Suite application tier from untrusted network segments.

How to Mitigate CVE-2026-70810

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update for August 2026 to all Oracle E-Business Suite installations running versions 12.2.3 through 12.2.15.
Restrict network access to Oracle Scripting endpoints so they are not reachable from untrusted networks or the public internet.
Audit recent access logs for signs of unauthenticated data retrieval against the Oracle Scripting component.

Patch Information

Oracle addressed CVE-2026-70810 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for exact patch identifiers, prerequisite bundles, and installation instructions for each supported Oracle E-Business Suite release.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or WAF that blocks unauthenticated requests to Oracle Scripting URLs until patches are applied.
Use network segmentation and firewall access control lists to limit HTTP access to trusted internal networks only.
Disable or restrict the Oracle Scripting module in environments where it is not required for business operations.

bash

# Example: restrict access to Oracle Scripting endpoints at the reverse proxy
# (Apache HTTP Server configuration snippet)
<Location "/OA_HTML/jtfrsapp">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>