CVE-2026-70786 is a vulnerability in the Oracle Service Fulfillment Manager component of Oracle E-Business Suite affecting versions 12.2.3 through 12.2.15. It allows a low-privileged attacker with network access over HTTP to compromise the system, requiring human interaction from a user other than the attacker. The vulnerability can lead to unauthorized access to critical data and unauthorized update, insert, or delete operations on some data. The vulnerability has a CVSS 3.1 score of 7.6 with vector AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N, indicating network attack vector, low attack complexity, low privileges required, user interaction required, scope change, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s Critical Security Patch Update advisory for August 2026 includes this vulnerability and recommends applying patches promptly. No direct exploit in the wild is reported.

Successful exploitation can result in unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data within Oracle Service Fulfillment Manager. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of the vulnerability extends beyond Oracle Service Fulfillment Manager to potentially impact additional Oracle products. The attack requires network access via HTTP and user interaction from a person other than the attacker.

Oracle has included this vulnerability in its August 2026 Critical Security Patch Update advisory and strongly recommends applying the relevant security patches without delay. Users should review the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. No alternative mitigations or temporary fixes are indicated in the advisory. Maintaining actively supported versions and timely patching is critical to mitigate this vulnerability.