This vulnerability affects Oracle Purchasing within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by an attacker with low privileges who has logon access to the infrastructure hosting Oracle Purchasing. Successful exploitation can result in complete compromise of Oracle Purchasing. The CVSS 3.1 vector indicates local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vendor advisory references Oracle's Critical Security Patch Update for August 2026 but does not explicitly confirm patch availability for this specific vulnerability.

An attacker with low privileges and logon access to the Oracle Purchasing infrastructure can exploit this vulnerability to fully compromise Oracle Purchasing. This includes potential unauthorized access, modification, and disruption of Oracle Purchasing operations, impacting confidentiality, integrity, and availability of the system.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (August 2026). Although the vendor advisory does not explicitly confirm a patch specifically for CVE-2026-70798, it is included in the August 2026 Critical Security Patch Update containing numerous fixes. Customers should remain on actively supported versions and apply the latest security patches without delay to mitigate this vulnerability.