Description
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in the Oracle Customers Online component of Oracle E‑Business Suite allows a remote attacker with low privilege who can reach the system over HTTP to compromise the application. An exploit can lead to full takeover of Oracle Customers Online, resulting in loss of confidentiality, integrity, and availability. The weakness is rated with a CVSS 3.1 base score of 8.8, indicating a high‑impact attack.

Affected Systems

Affected are Oracle Customers Online within Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15. The weakness resides in the Customer Tab component.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. No EPSS score is supplied, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP, requiring only low privilege. Successful exploitation would give the attacker control over the application, enabling data exfiltration, modification, or denial of service.

Generated by OpenCVE AI on August 19, 2026 at 01:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Customers Online security patch or upgrade to a version that includes the fix, as detailed in Oracle’s August 2026 security alert.
  • Restrict HTTP access to Oracle Customers Online to trusted networks or VPNs to reduce exposure to untrusted IP addresses.
  • Configure application firewall or web application firewall rules to block unexpected or malformed requests targeting the Customer Tab component.

Generated by OpenCVE AI on August 19, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 19 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability in Oracle Customers Online Enabling Application Takeover
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle customers Online
CPEs cpe:2.3:a:oracle:customers_online:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle customers Online
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Customers Online
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-18T21:01:20.746Z

Reserved: 2026-08-04T22:06:34.594Z

Link: CVE-2026-70747

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T21:17:27.560

Modified: 2026-08-18T21:17:27.560

Link: CVE-2026-70747

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T02:00:05Z

Weaknesses