CVE-2026-70947 Overview
CVE-2026-70947 is a high-severity vulnerability in the Oracle Purchasing component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can exploit the issue to compromise Oracle Purchasing. Successful exploitation grants unauthorized access to critical data or complete access to all Oracle Purchasing accessible data. The vulnerability is categorized under [CWE-284] Improper Access Control and impacts confidentiality only.
Critical Impact
Remote, unauthenticated attackers can read all data accessible to Oracle Purchasing over HTTP without user interaction.
Affected Products
- Oracle E-Business Suite, Oracle Purchasing component, version 12.2.3
- Oracle E-Business Suite, Oracle Purchasing versions 12.2.4 through 12.2.14
- Oracle E-Business Suite, Oracle Purchasing version 12.2.15
Discovery Timeline
- 2026-08-18 - CVE-2026-70947 published to NVD
- 2026-08-20 - Last updated in NVD database
- August 2026 - Addressed in the Oracle Security Alert August 2026
Technical Details for CVE-2026-70947
Vulnerability Analysis
The vulnerability resides in the Oracle Purchasing product of Oracle E-Business Suite and is reachable through the HTTP interface exposed by the suite. Oracle categorizes the affected component as "Other issue," and the CWE classification of [CWE-284] Improper Access Control indicates that the application fails to enforce authorization checks before returning sensitive data.
An attacker who reaches the vulnerable endpoint over the network can retrieve records that should be restricted to authenticated Purchasing users. The impact is confined to confidentiality; integrity and availability are not affected. Given the EPSS probability of 0.287% at the 21st percentile, opportunistic exploitation is currently modest, but Oracle E-Business Suite deployments are high-value targets for data theft.
Root Cause
The root cause is missing or inadequate access control on an Oracle Purchasing HTTP endpoint. The application does not validate that the requester is authenticated or authorized before serving data. Oracle has not publicly disclosed the specific endpoint or code path, and no proof-of-concept is available.
Attack Vector
Exploitation requires only network access to the Oracle E-Business Suite HTTP interface. No credentials, privileges, or user interaction are needed. An attacker sends crafted HTTP requests to the vulnerable Purchasing endpoint and receives data that access control checks should have withheld.
No verified exploit code is available. Refer to the Oracle Security Alert August 2026 for vendor-provided technical context.
Detection Methods for CVE-2026-70947
Indicators of Compromise
- Unauthenticated HTTP requests to Oracle Purchasing URLs (paths under /OA_HTML/ associated with Purchasing modules) returning HTTP 200 responses containing purchasing records.
- Unusual volumes of GET requests from a single external IP to Oracle E-Business Suite endpoints without a preceding authentication session.
- Web server access logs showing responses with large payload sizes to sessions that never completed login.
Detection Strategies
- Inspect Oracle HTTP Server and reverse proxy logs for anonymous access patterns to Purchasing endpoints, correlating request paths with session cookies or the absence thereof.
- Deploy signatures on web application firewalls that flag requests to Oracle Purchasing paths lacking valid authenticated session tokens.
- Baseline normal Purchasing traffic per source IP and alert on statistical deviations in request rate or response size.
Monitoring Recommendations
- Forward Oracle E-Business Suite web tier and database audit logs to a centralized analytics platform for correlation and long-term retention.
- Monitor Oracle FND audit tables for read patterns against PO_HEADERS_ALL, PO_LINES_ALL, and supplier tables that do not map to authenticated user sessions.
- Alert on egress traffic anomalies from Oracle E-Business Suite application servers that could indicate data exfiltration following exploitation.
How to Mitigate CVE-2026-70947
Immediate Actions Required
- Apply the fixes from the Oracle Security Alert August 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
- Inventory internet-exposed Oracle E-Business Suite instances and restrict access to trusted networks until patching completes.
- Review web server logs for the past 90 days to identify anonymous access to Purchasing endpoints.
Patch Information
Oracle released the fix as part of the August 2026 Security Alert. Administrators should apply the Critical Patch Update associated with Oracle E-Business Suite 12.2 and validate that the Purchasing patchset is present on all application tier nodes. Consult the Oracle Security Alert August 2026 for patch identifiers and prerequisite steps.
Workarounds
- Place Oracle E-Business Suite behind an authenticating reverse proxy or VPN so unauthenticated HTTP requests cannot reach the Purchasing endpoints.
- Configure Oracle HTTP Server mod_rewrite rules to block anonymous requests to Purchasing URLs pending patch deployment.
- Restrict inbound network access to the Oracle E-Business Suite web tier using firewall allowlists limited to required business partners and internal users.
# Example Oracle HTTP Server rule to block anonymous access to Purchasing paths
# Place in the mod_rewrite section and restart the OHS listener after applying
RewriteEngine On
RewriteCond %{HTTP_COOKIE} !oracle\.uix= [NC]
RewriteRule ^/OA_HTML/.*PO.*$ - [F,L]
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
