CVE-2026-70837: High severity Oracle Oracle E-Business Suite - Oracle Financials for Asia/Pacific vulnerability
Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financials for Asia/Pacific. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Financials for Asia/Pacific accessible data as well as unauthorized read access to a subset of Oracle Financials for Asia/Pacific accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle E-Business Suite - Oracle Financials for Asia/Pacific (Internal Operations)to a version that resolves this vulnerability.Fixed in 12.2.3-12.2.15 - Compensating control
Mitigate by restricting network access to the Oracle Financials for Asia/Pacific HTTP interface so low-privileged attackers cannot reach it (the issue is exploitable over HTTP via network access).
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments of Oracle Financials for Asia/Pacific in Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected. Exploitation requires network access to the vulnerable component over HTTP and an attacker account with low privileges.
What could an attacker do after successful exploitation?
A successful attacker could create, delete, or modify critical data or all data accessible through Oracle Financials for Asia/Pacific. They could also gain unauthorized read access to a subset of accessible data.
Is user interaction required for exploitation?
No. The CVSS vector indicates no user interaction is required, and the vulnerability is described as easily exploitable with low attack complexity.