Description
Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in Oracle General Ledger allows a low‑privileged attacker with network access via HTTP to gain control of the application. Successful exploitation results in a full takeover of Oracle General Ledger, providing the attacker with complete read, modify, and delete capabilities and affecting confidentiality, integrity, and availability.

Affected Systems

Oracle General Ledger, part of Oracle E‑Business Suite, is affected in supported versions 12.2.3 through 12.2.15. Users of these releases should verify they are running one of the specified versions.

Risk and Exploitability

The CVSS v3.1 Base Score of 8.8 indicates high severity. The EPSS score is 0.00447 (< 1%), and the flaw is not listed in CISA’s KEV catalog. The attack vector is network‑based via HTTP, with low access and privilege requirements, meaning an attacker does not need privileged credentials. Given the high CVSS score and the low barrier to exploitation, the risk is significant. Successful attacks can result in total application compromise.

Generated by OpenCVE AI on August 21, 2026 at 11:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle's latest patch or upgrade to a version that contains the fix for Oracle General Ledger 12.2.3‑12.2.15.
  • Restrict HTTP access to the General Ledger application by implementing firewall rules or network segmentation to limit exposure to only trusted internal traffic.
  • Monitor authentication and activity logs for unusual access patterns or repeated failed attempts that may indicate exploitation attempts.

Generated by OpenCVE AI on August 21, 2026 at 11:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Exploitable HTTP Vulnerability Enables Complete Oracle General Ledger Takeover
Weaknesses CWE-269
CWE-284

Fri, 21 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Oracle General Ledger Remote Code Execution via Low‑Privilege HTTP Access
Weaknesses CWE-287

Wed, 19 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Oracle General Ledger Remote Code Execution via Low‑Privilege HTTP Access
Weaknesses CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle General Ledger. Successful attacks of this vulnerability can result in takeover of Oracle General Ledger. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle general Ledger
CPEs cpe:2.3:a:oracle:general_ledger:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle general Ledger
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle General Ledger
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-26T03:56:17.352Z

Reserved: 2026-08-04T22:06:34.589Z

Link: CVE-2026-70686

cve-icon Vulnrichment

Updated: 2026-08-25T16:00:19.086Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:20.540

Modified: 2026-08-26T05:18:15.830

Link: CVE-2026-70686

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T11:15:03Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-284

    Improper Access Control