CVE-2026-70833: Oracle Landed Cost Management Auth Bypass

CVE-2026-70833 Overview

CVE-2026-70833 affects the Oracle Landed Cost Management product within Oracle E-Business Suite. The flaw resides in the Internal Operations component and impacts supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access over HTTP can exploit this vulnerability without user interaction.

Successful exploitation grants unauthorized access to all Oracle Landed Cost Management accessible data. Attackers can also perform unauthorized update, insert, or delete operations on a subset of that data. Oracle addressed the issue in the August 2026 Critical Patch Update.

Critical Impact
Authenticated network attackers can read all data accessible to Oracle Landed Cost Management and modify a subset of it, resulting in high confidentiality impact and partial integrity loss across supply chain and cost accounting records.

Affected Products

Oracle E-Business Suite — Oracle Landed Cost Management 12.2.3
Oracle E-Business Suite — Oracle Landed Cost Management versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Landed Cost Management 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70833 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70833

Vulnerability Analysis

The vulnerability exists in the Internal Operations component of Oracle Landed Cost Management. Oracle Landed Cost Management tracks freight, duties, insurance, and other charges that contribute to the total cost of imported goods. The affected component handles internal operational workflows exposed over HTTP within the Oracle E-Business Suite application tier.

An authenticated user with any low-privilege application account can reach the vulnerable functionality across the network. No user interaction or elevated privileges are required to trigger the flaw. Exploitation yields full read access to data the module handles, along with limited write capabilities on a subset of that data.

The scope remains unchanged, so impact is confined to the Landed Cost Management module. However, that module aggregates supplier pricing, purchase order costs, and shipment data, which are sensitive to competitive intelligence and financial reporting.

Root Cause

Oracle has not published the specific weakness class or code-level root cause in the Critical Patch Update advisory. Based on the CVSS profile, the flaw appears to stem from insufficient authorization enforcement on an HTTP-accessible operation, allowing a low-privileged account to reach data and functions beyond its intended role. Consult the Oracle Security Alert August 2026 for authoritative technical detail.

Attack Vector

Exploitation occurs over the network via HTTP to the Oracle E-Business Suite application tier. The attacker requires valid low-privileged credentials for the E-Business Suite instance. Once authenticated, the attacker issues crafted requests to Internal Operations endpoints to read or modify Landed Cost Management data. Attack complexity is low and no user interaction is required.

No verified proof-of-concept code has been published. See the Oracle Security Alert August 2026 for further technical detail.

Detection Methods for CVE-2026-70833

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts to Landed Cost Management Internal Operations URLs
Anomalous read volumes against INV.CST_LC_* and related Landed Cost Management tables outside normal business hours
Unauthorized inserts, updates, or deletes on Landed Cost Management records not tied to a documented change request
Session activity from accounts that do not normally access the Landed Cost Management responsibility

Detection Strategies

Enable Oracle E-Business Suite Sign-On Audit and Page Access Tracking to record navigation to Landed Cost Management functions.
Correlate application-tier HTTP access logs with database audit logs to identify low-privileged users touching cost management data.
Build alerts for row-level changes on Landed Cost Management tables performed outside integration service accounts.

Monitoring Recommendations

Forward Oracle E-Business Suite application, middle-tier, and database audit logs to a centralized SIEM for correlation.
Baseline normal user-to-responsibility mappings and alert on deviations affecting Landed Cost Management.
Monitor for account enumeration or credential stuffing against the E-Business Suite login page, since exploitation requires valid credentials.

How to Mitigate CVE-2026-70833

Immediate Actions Required

Apply the fixes documented in the Oracle Critical Patch Update Advisory of August 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Inventory all Oracle E-Business Suite instances running Landed Cost Management and prioritize internet-exposed tiers.
Review recent access to Landed Cost Management data by low-privileged accounts and validate against expected business activity.
Rotate credentials for accounts that showed anomalous activity in access logs prior to patching.

Patch Information

Oracle released fixes for CVE-2026-70833 as part of the Critical Patch Update published in August 2026. Refer to the Oracle Security Alert August 2026 for patch identifiers, prerequisites, and application instructions for E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Restrict network access to the Oracle E-Business Suite application tier using firewalls, reverse proxies, or VPN so only authorized users can reach HTTP endpoints.
Remove the Landed Cost Management responsibility from user accounts that do not require it, reducing the pool of accounts that can reach the vulnerable component.
Enforce strong authentication and monitor for anomalous logins on low-privileged application accounts until patches are deployed.

bash

# Configuration example: restrict Landed Cost Management endpoints at the reverse proxy
# Replace <trusted_subnet> with your operational network range
Location /OA_HTML/RF.jsp
    # Allow only trusted internal subnets to reach Landed Cost Management flows
    Require ip <trusted_subnet>
    # Log every request for post-incident review
    CustomLog logs/ebs_lcm_access.log combined
/Location