CVE-2026-70779

Published Aug 18, 2026 CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Description

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupplier Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

Analysis

Technical impact

A flaw in Oracle iSupplier Portal enables attackers who can reach the service via HTTP to create, delete, or modify critical data without authentication. The vulnerability results in confidentiality and integrity breaches for all data that the portal exposes. The attack requires no privileged credentials, lowering the barrier to exploitation.

Affected Systems

Vulnerable versions are Oracle iSupplier Portal 12.2.3 through 12.2.15, part of the Oracle E‑Business Suite Internal Operations component. The vulnerability affects installations that expose the portal’s HTTP interface to a network, whether internally or externally.

Risk and Exploitability

The CVSS base score of 7.4 reflects high confidentiality and integrity impact, and the attack vector is network based but requires unauthenticated access over HTTP. Based on the description, it is inferred that the exploit requires moderate technical skill and network reachability. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation but still posing a significant risk in exposed environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Oracle Corporation

Oracle iSupplier Portal

affected

Version	Status	Constraints
`12.2.3`	affected	≤ 12.2.15

Configuration 1 [-]

cpe:2.3:a:oracle:isupplier_portal:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Oracle

Isupplier Portal

Version	Status	Scheme	Platform
`[12.2.3,12.2.15]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply any available Oracle updates that address the iSupplier Portal 12.2.3 through 12.2.15 versions.
If no update is available, block HTTP traffic to the portal from untrusted networks using firewalls or ACLs.
Enable detailed logging and real‑time monitoring to detect unauthorized data operations on the portal.

Generated by OpenCVE AI on August 24, 2026 at 23:07 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.340% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.oracle.com/security-alerts/cspuaug2026.html

History

Aug 24, 2026 11:30 PM Title updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated HTTP Access Enables Data Modification in Oracle iSupplier Portal

Aug 24, 2026 9:45 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTP Access Enables Data Modification in Oracle iSupplier Portal
Weaknesses	CWE-306

Aug 24, 2026 4:30 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 21, 2026 6:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-306

Aug 19, 2026 1:00 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title	Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle iSupplier Portal
Weaknesses	CWE-284 CWE-287

Aug 19, 2026 3:15 AM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Unauthenticated HTTP Access Enables Unauthorized Data Manipulation in Oracle iSupplier Portal
Weaknesses		CWE-284 CWE-287

Aug 18, 2026 9:15 PM Description updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle iSupplier Portal accessible data as well as unauthorized access to critical data or complete access to all Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared		Oracle Oracle isupplier Portal
CPEs		cpe:2.3:a:oracle:isupplier_portal::::::::
Vendors & Products		Oracle Oracle isupplier Portal
References		https://www.oracle.com/security-alerts/cspuaug2026.html
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}`