CVE-2026-70947: Oracle Purchasing Auth Bypass Vulnerability

CVE-2026-70947 Overview

CVE-2026-70947 is a high-severity access control vulnerability in the Oracle Purchasing product of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15 and resides in an unspecified component described as Other issue. An unauthenticated attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation results in unauthorized access to critical Oracle Purchasing data or complete disclosure of all data accessible to the application. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
Unauthenticated remote attackers can obtain complete read access to sensitive Oracle Purchasing data over HTTP without user interaction.

Affected Products

Oracle E-Business Suite — Oracle Purchasing 12.2.3
Oracle E-Business Suite — Oracle Purchasing versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70947 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70947

Vulnerability Analysis

The vulnerability affects the Oracle Purchasing module within Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15. Oracle categorizes the issue under the generic Other issue component, indicating the specific subcomponent has not been publicly disclosed. The flaw permits unauthenticated HTTP access to functionality or data that should be protected by authorization controls. Exploitation yields confidentiality impact only, with no direct effect on data integrity or system availability. The Exploit Prediction Scoring System places this issue at a probability of 0.303%, placing it in the 22.98 percentile of scored CVEs.

Root Cause

The root cause is improper access control [CWE-284] within HTTP-facing endpoints of Oracle Purchasing. The application fails to enforce authentication or authorization checks on a request path that exposes sensitive purchasing data. Because the check is missing rather than misconfigured, standard credential or session controls do not mitigate the exposure. Oracle has not published the specific endpoint or data flow involved.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests directly to the exposed Oracle E-Business Suite instance. No credentials, prior access, or user interaction are required. The attack complexity is low, meaning the exploitation path is repeatable and does not depend on race conditions or environmental factors. Successful requests return purchasing data such as vendor information, purchase orders, pricing, or other records accessible to the Purchasing application.

No public proof-of-concept code has been released. For technical remediation details, consult the Oracle Security Alert.

Detection Methods for CVE-2026-70947

Indicators of Compromise

Unauthenticated HTTP requests to Oracle E-Business Suite Purchasing endpoints originating from external or unexpected internal sources.
Anomalous response sizes from /OA_HTML/ or Purchasing-related URLs indicating bulk data retrieval.
HTTP 200 OK responses to requests that lack valid session cookies or authentication headers.
Sudden spikes in outbound data volume from Oracle E-Business Suite application tier hosts.

Detection Strategies

Review Oracle E-Business Suite access logs for unauthenticated requests to Purchasing URLs that return non-error responses.
Deploy web application firewall rules to flag HTTP requests to Purchasing endpoints that lack authenticated session context.
Correlate application-tier HTTP logs with database audit logs to identify Purchasing data reads not tied to an authenticated user.
Baseline normal request patterns for the Purchasing module and alert on deviations in URL access frequency or payload size.

Monitoring Recommendations

Enable Oracle E-Business Suite FND (Foundation) audit logging for Purchasing-related responsibilities and forms.
Forward Apache/Oracle HTTP Server access logs to a centralized SIEM for correlation with identity and network telemetry.
Monitor Oracle database audit trails for queries against PO_* schema tables initiated by the application tier without a corresponding user session.
Track egress traffic volumes from application-tier hosts to detect large data extractions.

How to Mitigate CVE-2026-70947

Immediate Actions Required

Apply the fixes documented in the Oracle Critical Patch Update Security Alert (August 2026) as soon as testing allows.
Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and confirm patch status.
Restrict inbound HTTP access to Oracle E-Business Suite so only authorized networks can reach the application tier.
Audit Oracle Purchasing HTTP access logs for signs of prior unauthenticated data retrieval.

Patch Information

Oracle addressed CVE-2026-70947 in the Critical Patch Update Security Alert dated August 2026. Administrators should download and apply the patch identified for Oracle Purchasing on each affected 12.2.x deployment. Full patch details, prerequisites, and product-specific instructions are documented in the Oracle Security Alert.

Workarounds

Place Oracle E-Business Suite behind a reverse proxy or web application firewall that enforces authentication before Purchasing URLs are reachable.
Apply network segmentation to limit access to the Oracle E-Business Suite application tier to trusted internal subnets and VPN clients.
Disable or block the specific Oracle Purchasing HTTP paths that are not required for business operations until the patch is applied.
Increase logging verbosity on the Oracle HTTP Server to capture full request URIs and source IPs for post-incident review.

bash

# Configuration example: restrict access to Oracle Purchasing URLs at the Oracle HTTP Server layer
<Location /OA_HTML/>
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.0.0/16
</Location>