CVE-2026-70811: Oracle Purchasing Auth Bypass Vulnerability

CVE-2026-70811 Overview

CVE-2026-70811 affects the Oracle Purchasing product within Oracle E-Business Suite, specifically the Internal Operations component. The flaw impacts supported versions 12.2.5 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation grants unauthorized read, create, delete, or modify access to all Oracle Purchasing accessible data. Oracle disclosed the issue in its August 2026 Critical Patch Update and assigned it a CVSS 3.1 base score of 8.1, reflecting high confidentiality and integrity impact.

Critical Impact
An authenticated network attacker can compromise all data accessible through Oracle Purchasing, including creation, deletion, and modification of critical procurement records.

Affected Products

Oracle E-Business Suite — Oracle Purchasing 12.2.5
Oracle E-Business Suite — Oracle Purchasing versions 12.2.6 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70811 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70811

Vulnerability Analysis

The vulnerability resides in the Internal Operations component of Oracle Purchasing, a module of Oracle E-Business Suite used for procurement workflows. An authenticated user with low privileges can send crafted HTTP requests to reach functionality that should be restricted. The flaw allows the attacker to read, create, modify, or delete records across the full scope of data accessible to Oracle Purchasing.

Because the scope remains unchanged, the compromise is bounded by the security authority of the Purchasing application. However, procurement systems typically contain sensitive supplier data, pricing information, contract terms, and purchase order records. Exploitation therefore has direct impact on financial and supply chain integrity.

Root Cause

Oracle has not published root-cause details. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N and impact profile are consistent with a broken access control or authorization flaw in the Internal Operations component. The requirement for low-level privileges indicates the flaw is reachable by any authenticated E-Business Suite user with access to Purchasing functions.

Attack Vector

Exploitation occurs over the network via HTTP against the E-Business Suite web tier. The attacker must hold valid low-privileged credentials in the target environment. No user interaction is required, and attack complexity is low. Refer to the Oracle Security Alert - August 2026 for authoritative product notes.

No verified proof-of-concept code is available. The vulnerability mechanism is described in prose only; consult the Oracle advisory for further technical detail.

Detection Methods for CVE-2026-70811

Indicators of Compromise

Unexpected creation, modification, or deletion of purchase orders, requisitions, or supplier records by low-privileged accounts.
HTTP requests targeting Oracle Purchasing Internal Operations endpoints originating from user sessions that historically do not access those functions.
Anomalous database write activity against Purchasing schema tables outside of scheduled batch windows.

Detection Strategies

Correlate application audit logs from Oracle E-Business Suite with web tier access logs to identify low-privileged users invoking Internal Operations functions.
Baseline normal Purchasing activity per user role and alert on deviations such as bulk record changes or access to unrelated supplier data.
Enable Oracle E-Business Suite Sign-On Audit and Function Security auditing to capture privilege use in the Purchasing responsibility.

Monitoring Recommendations

Forward E-Business Suite application, database, and middle-tier logs to a centralized analytics platform for correlation and long-term retention.
Monitor for repeated HTTP 200 responses to unusual Purchasing URLs, which may indicate successful exploitation attempts.
Track privileged data changes in PO_HEADERS_ALL, PO_LINES_ALL, and related Purchasing tables for unexpected modifications.

How to Mitigate CVE-2026-70811

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update for August 2026 to all Oracle E-Business Suite environments running Purchasing versions 12.2.5 through 12.2.15.
Inventory all E-Business Suite instances, including non-production and disaster recovery copies, and schedule patch deployment.
Review recent Purchasing audit logs for signs of unauthorized data creation, modification, or deletion prior to patching.

Patch Information

Oracle released remediation as part of its August 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert - August 2026. Follow Oracle's standard E-Business Suite patch application procedure, including pre-patch backup and post-patch validation of Purchasing workflows.

Workarounds

Restrict network access to the E-Business Suite web tier to trusted internal networks and VPN clients until patching is complete.
Review and tighten responsibilities and menu assignments so that only required users hold access to Oracle Purchasing.
Enforce multi-factor authentication for all E-Business Suite user accounts to raise the barrier for credential compromise.

bash

# Configuration example
# Refer to the Oracle Critical Patch Update advisory for exact patch identifiers
# and apply using standard EBS patching tooling, for example:
# adop phase=apply patches=<patch_number> workers=<n>