CVE-2026-70710: High severity Oracle Oracle Sales Foundation (Oracle E-Business Suite) vulnerability
Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation. Successful attacks of this vulnerability can result in takeover of Oracle Sales Foundation. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite (Oracle Sales Foundation) - Security APIto a version that resolves this vulnerability.Fixed in 12.2.15
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs network access to the affected Oracle Sales Foundation instance over HTTP and valid low-privileged credentials. No user interaction is required.
Which deployments are affected?
Affected supported versions are Oracle Sales Foundation in Oracle E-Business Suite versions 12.2.3 through 12.2.15, specifically the Security API component.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of Oracle Sales Foundation, with high impact to confidentiality, integrity, and availability.