CVE-2026-70791 is a vulnerability in Oracle Transportation Execution component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the system, requiring user interaction from a person other than the attacker. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized read access to some data within Oracle Transportation Execution. The vulnerability has a CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N and a base score of 7.6, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, limited confidentiality impact, high integrity impact, and no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update and advises customers to apply patches without delay.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Transportation Execution, as well as unauthorized read access to some data. The vulnerability affects confidentiality and integrity of data, with no impact on availability. Due to scope change, other Oracle products may also be impacted by attacks exploiting this vulnerability.

Oracle has released a Critical Security Patch Update in August 2026 that includes fixes for this vulnerability. Customers are strongly advised to apply the available patches promptly to mitigate the risk. No additional mitigation steps are specified by the vendor advisory. Staying on actively supported versions and applying security patches without delay is recommended.