CVE-2026-70835 affects Oracle iRecruitment versions 12.2.3 to 12.2.15 and allows a low privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle iRecruitment. The vulnerability is rated with a CVSS 3.1 score of 8.1, reflecting high confidentiality and integrity impacts but no availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data or full access to all data accessible by Oracle iRecruitment. This compromises the confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the relevant patches for Oracle iRecruitment versions 12.2.3 through 12.2.15 promptly. Oracle strongly advises remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch status is confirmed by the vendor advisory.