CVE-2026-70718 is a vulnerability in the Oracle Bills of Material product within Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access over HTTP to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. Oracle has included a fix for this vulnerability in its August 2026 Critical Security Patch Update, which contains 943 security patches across multiple products. The vendor strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to complete compromise (takeover) of Oracle Bills of Material, affecting confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products may also be significantly impacted. The vulnerability requires network access via HTTP and low privileges, but has a high attack complexity. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in August 2026 that addresses CVE-2026-70718 among other vulnerabilities. Customers should apply the official patches provided by Oracle promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No additional mitigation steps are indicated beyond applying the official patch.