CVE-2026-70845

Received Received - Intake

Oracle Loans Unauthorized Data Modification Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Loans accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Loans. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-70845

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	loans	From 12.2.3 (inc) to 12.2.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Loans within Oracle E-Business Suite. It allows a low-privileged attacker with network access to exploit it via HTTP. Successful exploitation can lead to unauthorized data creation, deletion, or modification, as well as partial denial of service affecting Oracle Loans.

Detection Guidance

Detection requires monitoring Oracle Loans logs for unauthorized data modifications or access attempts. Check HTTP traffic logs for unusual requests targeting the Oracle Loans component. Review database logs for unexpected changes to critical data.

Impact Analysis

An attacker could gain unauthorized access to critical data in Oracle Loans, modify or delete sensitive information, or disrupt service availability. This could lead to data breaches, financial loss, or operational disruptions for organizations using the affected software versions.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity and availability. Non-compliance risks include fines, legal penalties, and reputational damage.

Mitigation Strategies

Apply Oracle's official patches or updates for Oracle Loans immediately. Restrict network access to the Oracle Loans component via firewalls or network segmentation. Monitor and audit Oracle Loans data for unauthorized changes.

Hi! I’m here to help you understand CVE-2026-70845. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70