CVE-2026-70808 is a vulnerability in the Oracle Scripting component of Oracle E-Business Suite (versions 12.2.3 to 12.2.15). It permits a low-privileged attacker with network access via HTTP to compromise Oracle Scripting, resulting in unauthorized access to critical or all accessible data and unauthorized modification capabilities (update, insert, delete) on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has included fixes for this vulnerability in its August 2026 Critical Security Patch Update. The vendor strongly recommends applying these patches without delay to mitigate exploitation risks.

Successful exploitation of this vulnerability can lead to unauthorized access to critical or all data accessible by Oracle Scripting, as well as unauthorized data modification (update, insert, delete) on some data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. The vulnerability is exploitable remotely over the network with low privileges and no user interaction required, increasing the risk of attack.

Oracle has released patches addressing this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the vendor advisory.