CVE-2026-70779 affects Oracle iSupplier Portal component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It is a difficult to exploit vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the portal, potentially resulting in unauthorized creation, deletion, or modification of critical data or full access to all accessible data. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact without availability impact. Oracle's August 2026 Critical Security Patch Update advisory includes this vulnerability among 943 fixes and strongly recommends applying patches without delay. No known exploits in the wild have been reported.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible via Oracle iSupplier Portal. This impacts confidentiality and integrity of the data but does not affect availability. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.4. No known exploits in the wild have been reported to date.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory and strongly recommends that customers apply the available patches promptly. Since no direct patch link was provided, users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Maintaining actively supported versions and timely patching is critical to mitigate this vulnerability. No vendor advisory states that no action is required or that the issue is already mitigated without patching.