CVE-2026-70948: Oracle Purchasing Privilege Escalation Flaw

CVE-2026-70948 Overview

CVE-2026-70948 is an access control vulnerability [CWE-284] in the Oracle Purchasing component of Oracle E-Business Suite. The flaw affects supported versions 12.2.3 through 12.2.15. A low-privileged attacker with network access via HTTP can exploit the weakness without user interaction. Successful exploitation results in full takeover of Oracle Purchasing, impacting confidentiality, integrity, and availability.

Oracle addressed the issue in the Oracle Security Alert August 2026.

Critical Impact
An authenticated attacker with minimal privileges can take over Oracle Purchasing over the network, exposing procurement data, financial workflows, and supplier information.

Affected Products

Oracle E-Business Suite — Oracle Purchasing 12.2.3
Oracle E-Business Suite — Oracle Purchasing versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Purchasing 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70948 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70948

Vulnerability Analysis

The vulnerability resides in the Oracle Purchasing product of Oracle E-Business Suite and is categorized under Improper Access Control [CWE-284]. Oracle's advisory describes the affected element only as an "Other issue" component. An authenticated attacker with low privileges can send crafted HTTP requests to reach protected functionality without additional authorization checks.

The issue is remotely exploitable over HTTP and requires no user interaction. Oracle rates successful exploitation as leading to full takeover of the Purchasing module, meaning the attacker can read, modify, and disrupt procurement records. Because Oracle Purchasing integrates with supplier management, accounts payable, and general ledger, compromise can cascade into broader financial workflows.

Root Cause

The underlying weakness is improper access control on functionality exposed by Oracle Purchasing. The application does not correctly enforce authorization checks for a resource reachable by any authenticated user of the E-Business Suite. As a result, privilege boundaries between standard users and privileged Purchasing operations are not maintained. Oracle does not publish the exact code path affected. Refer to the Oracle Security Alert August 2026 for vendor guidance.

Attack Vector

An attacker who holds valid low-privileged credentials for the E-Business Suite instance issues HTTP requests to the Oracle Purchasing endpoints exposed by the application tier. Because attack complexity is low and no user interaction is required, exploitation can be automated once a foothold account is available. Credentials obtained through phishing, credential stuffing, or reuse from other breaches all satisfy the prerequisite.

No verified proof-of-concept is publicly available. See the Oracle Security Alert
August 2026 for vendor-provided technical details and patch references.

Detection Methods for CVE-2026-70948

Indicators of Compromise

Unexpected modifications to purchase orders, requisitions, or supplier master data by low-privileged accounts.
Anomalous HTTP requests to Oracle Purchasing URLs (/OA_HTML/, Purchasing-related servlets and JSPs) from accounts that do not normally use those functions.
New or altered approval hierarchies, buyer assignments, or payment terms outside change-control windows.

Detection Strategies

Review Oracle E-Business Suite application-tier access logs for HTTP requests targeting Purchasing endpoints from user sessions that lack corresponding responsibilities.
Correlate FND_LOGIN and FND_LOGIN_RESPONSIBILITIES audit records with Purchasing table changes to spot authorization inconsistencies.
Enable Oracle E-Business Suite Signon Audit and page-access tracking to record which users invoke Purchasing functions.

Monitoring Recommendations

Forward application-tier and database audit logs to a centralized SIEM and alert on privilege-inconsistent activity against Purchasing objects.
Baseline normal Purchasing usage per user and responsibility, then alert on deviations such as volume spikes or off-hours activity.
Monitor egress from application-tier hosts for exfiltration patterns following authenticated Purchasing sessions.

How to Mitigate CVE-2026-70948

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert August 2026 to all affected Oracle E-Business Suite 12.2.3–12.2.15 environments.
Inventory all E-Business Suite instances, including non-production and disaster-recovery copies, and confirm Purchasing patch status.
Rotate credentials for accounts with any Purchasing responsibility and enforce multi-factor authentication on the E-Business Suite login flow.
Restrict network exposure of the E-Business Suite application tier to trusted networks and VPN users only.

Patch Information

Oracle released fixes as part of the August 2026 Security Alert cycle. Administrators should follow the Critical Patch Update readme, apply the E-Business Suite 12.2 patch bundle covering Oracle Purchasing, and validate the fix in a non-production environment before rolling to production. The advisory is available at the Oracle Security Alert August 2026.

Workarounds

Remove Purchasing responsibilities from user accounts that do not require them, following least-privilege principles.
Place the E-Business Suite application tier behind a web application firewall and restrict access to Purchasing URLs by source network and authenticated identity.
Increase audit logging on Purchasing tables (PO_HEADERS_ALL, PO_VENDORS, AP_SUPPLIERS) to shorten detection time until patching is complete.

bash

# Example: verify installed E-Business Suite Purchasing patch level
# Run as the applmgr user on the application tier
sqlplus apps/<password> <<'SQL'
SELECT patch_name, patch_type, last_update_date
  FROM ad_bugs
 WHERE bug_number IN ('<august-2026-po-patch-id>');
SQL