This vulnerability in Oracle Landed Cost Management (component: Internal Operations) allows an attacker with low privileges and network access via HTTP to compromise the system. Successful exploitation can result in unauthorized access to critical data or complete access to all data accessible by Oracle Landed Cost Management, as well as unauthorized update, insert, or delete operations on some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Affected versions are 12.2.3 through 12.2.15 inclusive. Oracle has published a Critical Security Patch Update advisory for August 2026 referencing this vulnerability but does not explicitly confirm patch availability for this specific issue in the provided content.

An attacker with low privileges and network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle Landed Cost Management. This includes the ability to read sensitive information and perform unauthorized modifications such as updates, inserts, or deletions on some accessible data. The confidentiality impact is high, and the integrity impact is low, with no impact on availability.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update program. Although the vendor advisory does not explicitly confirm a patch for CVE-2026-70833, it advises customers to remain on actively supported versions and apply available security patches without delay. Users should monitor Oracle's official security alerts and apply the relevant Critical Security Patch Updates to mitigate this vulnerability.