Description
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle General Ledger allows a low‑privileged attacker with network access via HTTP to gain control of the application. Successful exploitation results in a full takeover of Oracle General Ledger, providing the attacker with complete read, modify, and delete capabilities and affecting confidentiality, integrity, and availability.

Affected Systems

Oracle General Ledger, part of Oracle E‑Business Suite, is affected in supported versions 12.2.3 through 12.2.15. Users of these releases should verify they are running one of the specified versions.

Risk and Exploitability

The CVSS v3.1 Base Score of 8.8 indicates high severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is network‑based via HTTP, with low access and privilege requirements, meaning an attacker does not need privileged credentials. Given the high CVSS score and the low barrier to exploitation, the risk is significant. Successful attacks can result in total application compromise.

Generated by OpenCVE AI on August 19, 2026 at 01:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle's latest patch or upgrade to a version that contains the fix for Oracle General Ledger 12.2.3‑12.2.15.
  • Restrict HTTP access to the General Ledger application by implementing firewall rules or network segmentation to limit exposure to only trusted internal traffic.
  • Monitor authentication and activity logs for unusual access patterns or repeated failed attempts that may indicate exploitation attempts.

Generated by OpenCVE AI on August 19, 2026 at 01:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Oracle General Ledger Remote Code Execution via Low‑Privilege HTTP Access
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle general Ledger
CPEs cpe:2.3:a:oracle:general_ledger:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle general Ledger
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle General Ledger
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-18T21:01:00.705Z

Reserved: 2026-08-04T22:06:34.589Z

Link: CVE-2026-70686

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T21:17:20.540

Modified: 2026-08-18T21:17:20.540

Link: CVE-2026-70686

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T01:30:05Z

Weaknesses