This vulnerability affects Oracle Marketing Encyclopedia System component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical or all accessible data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality impact. The vendor advisory is part of Oracle's August 2026 Critical Security Patch Update, which includes 943 patches across multiple products. Oracle strongly recommends applying patches promptly but does not explicitly state a dedicated patch for this CVE in the advisory content provided.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the Oracle Marketing Encyclopedia System. The vulnerability affects confidentiality but does not impact integrity or availability. Due to scope change, other Oracle products may also be impacted by attacks leveraging this vulnerability.

Oracle recommends that customers remain on actively supported versions and apply security patches without delay as part of their Critical Security Patch Updates. Although the advisory does not explicitly confirm a patch for CVE-2026-70692, the August 2026 Critical Security Patch Update includes numerous fixes and should be reviewed and applied promptly. Patch status is not explicitly confirmed for this CVE; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest remediation guidance.