CVE-2026-70815

Received Received - Intake

Oracle Internet Procurement Connector Data Access Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Internet Procurement Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Internet Procurement Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Internet Procurement Connector accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70815

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	internet_procurement_connector	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Internet Procurement Connector within Oracle E-Business Suite. It allows low-privileged attackers with network access via HTTP to exploit it. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to all accessible data in the connector.

Detection Guidance

Detection requires checking for unauthorized access or modifications in Oracle Internet Procurement Connector. Monitor HTTP traffic for unusual requests targeting the component. Review logs for suspicious activity in Oracle E-Business Suite versions 12.2.3 to 12.2.15.

Impact Analysis

This vulnerability can result in unauthorized access to sensitive data, allowing attackers to modify or delete critical information. It may also lead to complete data exposure within the Oracle Internet Procurement Connector, potentially causing data breaches or integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to potential data breaches.

Mitigation Strategies

Apply Oracle's official patches or updates for the affected versions. Restrict network access to the Oracle Internet Procurement Connector component. Implement least privilege principles for user accounts accessing the system.

Hi! I’m here to help you understand CVE-2026-70815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70