CVE-2026-70755 is a vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite affecting versions 12.2.3 to 12.2.15. The vulnerability resides in the file download component and can be exploited by a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and high confidentiality impact without affecting integrity or availability. Oracle’s September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible via Oracle Web Applications Desktop Integrator. The confidentiality of sensitive information is at high risk, while integrity and availability are not impacted. The vulnerability requires network access and low privileges but no user interaction, making it moderately exploitable.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle E-Business Suite versions 12.2.3 through 12.2.15 promptly. Oracle strongly advises remaining on actively supported versions and applying security patches without delay to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are specified in the advisory.