CVE-2026-70775: Medium severity Oracle Oracle E-Business Suite - User Interface vulnerability
Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Installed Base accessible data as well as unauthorized read access to a subset of Oracle Installed Base accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Installed Base. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the Oracle Installed Base user interface over HTTP and low-privileged credentials. No user interaction is required.
Which deployments are affected?
Affected supported Oracle E-Business Suite versions are 12.2.3 through 12.2.15, specifically the Oracle Installed Base User Interface component.
What could a successful attacker do?
A successful attack can provide unauthorized read access to a subset of accessible Oracle Installed Base data, unauthorized update, insert, or delete access to some accessible data, and the ability to cause a partial denial of service.