Description
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in the Oracle Customers Online component of Oracle E‑Business Suite allows a remote attacker with low privilege who can reach the system over HTTP to compromise the application. An exploit can lead to full takeover of Oracle Customers Online, resulting in loss of confidentiality, integrity, and availability. The weakness is rated with a CVSS 3.1 base score of 8.8, indicating a high‑impact attack.

Affected Systems

Affected are Oracle Customers Online within Oracle E‑Business Suite, specifically versions 12.2.3 through 12.2.15. The weakness resides in the Customer Tab component.

Risk and Exploitability

The CVSS score of 8.8 classifies the flaw as high severity. The EPSS score is 0.00479, indicating a very low likelihood of exploitation, and the vulnerability is not yet listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP, requiring only low privilege. Successful exploitation would give the attacker control over the application, enabling data exfiltration, modification, or denial of service.

Generated by OpenCVE AI on August 21, 2026 at 08:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Customers Online security patch or upgrade to a version that includes the fix, as detailed in Oracle’s August 2026 security alert.
  • Restrict HTTP access to Oracle Customers Online to trusted networks or VPNs to reduce exposure to untrusted IP addresses.
  • Configure application firewall or web application firewall rules to block unexpected or malformed requests targeting the Customer Tab component.

Generated by OpenCVE AI on August 21, 2026 at 08:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 09:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Low‑Privilege HTTP Access in Oracle Customers Online
Weaknesses CWE-284

Fri, 21 Aug 2026 06:45:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability in Oracle Customers Online Enabling Application Takeover
Weaknesses CWE-284

Wed, 19 Aug 2026 02:15:00 +0000

Type Values Removed Values Added
Title Remote Access Vulnerability in Oracle Customers Online Enabling Application Takeover
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle customers Online
CPEs cpe:2.3:a:oracle:customers_online:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle customers Online
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Customers Online
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:09:30.430Z

Reserved: 2026-08-04T22:06:34.594Z

Link: CVE-2026-70747

cve-icon Vulnrichment

Updated: 2026-08-25T15:06:34.191Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:27.560

Modified: 2026-08-28T18:26:28.943

Link: CVE-2026-70747

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T08:45:12Z

Weaknesses