Description
Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in takeover of Oracle Teleservice. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the Service Request Form component of Oracle Teleservice permits an attacker with low privilege and network access via HTTP to compromise the application entirely. The vulnerability can lead to full takeover, resulting in loss of confidentiality, integrity, and availability of the affected system. The issue involves improper permission assignment (CWE‑284).

Affected Systems

Oracle Corporation's Oracle Teleservice, part of Oracle E‑Business Suite, is affected. The vulnerable versions include all releases from 12.2.3 through 12.2.15. The impact is on the Service Request Form functionality.

Risk and Exploitability

The flaw carries a high CVSS 3.1 base score of 8.8, indicating critical severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Attackers require only low privileges with network access over HTTP, making the vulnerability readily exploitable and enabling full takeover of the service.

Generated by OpenCVE AI on August 25, 2026 at 20:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Teleservice to a patched version when it becomes available
  • Limit HTTP access to the application by firewall or VPN so only trusted IPs can reach the Service Request Form
  • Disable or restrict the Service Request Form component if it is not required for business operations
  • Monitor HTTP traffic for anomalous requests and implement application‑level logging to detect exploitation attempts

Generated by OpenCVE AI on August 25, 2026 at 20:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTP Exploit Compromises Oracle Teleservice

Tue, 25 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Title Unprivileged HTTP Access Allows Full Takeover of Oracle Teleservice
Weaknesses CWE-20
CWE-269
CWE-89

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 21 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Unprivileged HTTP Access Allows Full Takeover of Oracle Teleservice
Weaknesses CWE-20
CWE-269
CWE-89

Wed, 19 Aug 2026 12:45:00 +0000

Type Values Removed Values Added
Title Oracle Teleservice Service Request Form Vulnerability Allowing Remote Takeover by Low‑Privilege Attacker
Weaknesses CWE-284
CWE-862

Wed, 19 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Title Oracle Teleservice Service Request Form Vulnerability Allowing Remote Takeover by Low‑Privilege Attacker
Weaknesses CWE-284
CWE-862

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Teleservice. Successful attacks of this vulnerability can result in takeover of Oracle Teleservice. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle teleservice
CPEs cpe:2.3:a:oracle:teleservice:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle teleservice
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Teleservice
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:10:46.942Z

Reserved: 2026-08-04T22:06:34.593Z

Link: CVE-2026-70729

cve-icon Vulnrichment

Updated: 2026-08-25T15:06:23.338Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:25.490

Modified: 2026-08-31T15:05:27.647

Link: CVE-2026-70729

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-25T21:00:04Z

Weaknesses