Threat Intelligence Database

A high-severity vulnerability exists in the Oracle Applications Manager component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. This vulnerability allows a low-privileged attacker with network access via HTTP to potentially take over the Oracle Applications Manager. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in its September 2026 Critical Security Patch Update advisory.

CVE-2026-70796 is a high-severity vulnerability in Oracle General Ledger, part of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It requires a high-privileged attacker with logon access to the infrastructure where Oracle General Ledger runs. Exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle General Ledger, potentially impacting additional Oracle products. The vulnerability has a CVSS 3.1 base score of 7.2, reflecting high confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory for August 2026 covering this and many other vulnerabilities. Patch availability details are provided in Oracle's advisory, and customers are strongly urged to apply patches promptly.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing multiple vulnerabilities in various components of Oracle E-Business Suite versions 12.2.3 through 12.2.15, among other Oracle products. The update includes 943 security patches across many Oracle product families. The vulnerabilities affect modules such as General Ledger, Payments, Workflow, Sales, Purchasing, Call Center Technology, and others. Oracle strongly recommends applying these patches promptly to mitigate risks, as some vulnerabilities have been subject to attempted exploitation. The patch update complements Oracle's quarterly cumulative Critical Patch Updates and aims to reduce disruption by providing targeted fixes. No CVSS score is provided for these vulnerabilities. No known exploits in the wild have been reported at this time.