CVE-2026-70796

Received Received - Intake

Privilege Escalation in Oracle General Ledger

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle General Ledger executes to compromise Oracle General Ledger. While the vulnerability is in Oracle General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle General Ledger accessible data as well as unauthorized access to critical data or complete access to all Oracle General Ledger accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70796

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	general_ledger	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle General Ledger within Oracle E-Business Suite. It affects versions 12.2.3 to 12.2.15 and allows a highly privileged attacker with local access to compromise the system. The vulnerability can lead to unauthorized data creation, modification, or deletion, as well as unauthorized access to critical data.

Impact Analysis

If exploited, this vulnerability could allow attackers to modify or delete critical financial data, access sensitive information, or disrupt Oracle General Ledger operations. Businesses relying on this software may face data breaches, financial losses, or operational disruptions.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this vulnerability.

Mitigation Strategies

Apply the latest Oracle E-Business Suite patches for Oracle General Ledger versions 12.2.3 to 12.2.15. Restrict access to the infrastructure hosting Oracle General Ledger to only high-privileged, trusted users. Monitor logs for unauthorized data access or modification attempts.

Hi! I’m here to help you understand CVE-2026-70796. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70