CVE-2026-70792 is a vulnerability in Oracle Yard Management (component of Oracle E-Business Suite Internal Operations) affecting versions 12.2.3 to 12.2.15. It allows a low privileged attacker with network access via HTTP to compromise the product, resulting in potential full system takeover. The vulnerability has a CVSS 3.1 score of 8.8 with high confidentiality, integrity, and availability impacts. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability among many others and strongly recommends applying patches without delay. The advisory does not explicitly list a direct patch link for this specific vulnerability but indicates that patches are available as part of the update.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Yard Management, impacting confidentiality, integrity, and availability of the system. This could allow an attacker to take over the affected Oracle product, potentially leading to unauthorized access and control over sensitive operations managed by Oracle Yard Management.

Oracle’s August 2026 Critical Security Patch Update includes fixes for this vulnerability. Customers are strongly advised to remain on actively supported versions and apply the security patches promptly to mitigate the risk. Since the product is not a cloud service, remediation depends on customers applying these patches. Patch status is confirmed by the vendor advisory indicating patches are available as part of the Critical Security Patch Update. No additional mitigation steps are specified beyond applying the official patches.