CVE-2026-70708 is a vulnerability in the Security API component of Oracle Sales Foundation within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to perform unauthorized actions such as creation, deletion, or modification of critical data, or gain unauthorized access to all data accessible by the product. The vulnerability has a CVSS 3.1 score of 8.1 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts but no availability impact. Oracle's August 2026 Critical Security Patch Update includes fixes addressing this vulnerability among others.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Sales Foundation, or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of the data but does not impact availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required.

Oracle has released patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers using affected versions (12.2.3 through 12.2.15) of Oracle Sales Foundation should apply the relevant patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate exploitation risks. Refer to the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions.