Description
Vulnerability in the Oracle Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Applications Platform Engineering. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-08-18
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Vulnerability in Oracle Applications Platform Engineering's Valid Session component permits an unauthenticated attacker with network access over Oracle Net to compromise the platform. Successful exploitation can lead to full takeover, affecting confidentiality, integrity and availability of the application.

Affected Systems

Oracle E‑Business Suite component Oracle Applications Platform Engineering, with supported versions from 12.2.3 to 12.2.15.

Risk and Exploitability

The flaw has a CVSS 3.1 base score of 8.1, indicating high severity. The EPSS score is less than 1%, indicating a very low probability of exploitation, but the absence of credential or UI requirements means the vulnerability can be leveraged remotely and without privilege, making it attractive to attackers. The vulnerability is not listed in the CISA KEV catalog, but its impact and network exposure warrant immediate attention.

Generated by OpenCVE AI on August 21, 2026 at 07:32 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and apply the Oracle patch referenced in the official security alert to fix the Valid Session flaw.
  • Configure network firewalls or segmentation to limit Oracle Net traffic to trusted hosts, reducing the attack surface.
  • Enable auditing for session creation in Oracle Applications Platform Engineering and regularly review logs for unauthorized activity.

Generated by OpenCVE AI on August 21, 2026 at 07:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Applications Platform Engineering
Vendors & Products Oracle Corporation
Oracle Corporation oracle Applications Platform Engineering

Fri, 21 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Leading to Oracle Applications Platform Engineering Takeover
Weaknesses CWE-284

Fri, 21 Aug 2026 05:45:00 +0000

Type Values Removed Values Added
Title Oracle Applications Platform Engineering Valid Session Vulnerability Allowing Unauthenticated Takeover
Weaknesses CWE-284

Wed, 19 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Oracle Applications Platform Engineering Valid Session Vulnerability Allowing Unauthenticated Takeover
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Oracle Applications Platform Engineering. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle applications Platform Engineering
CPEs cpe:2.3:a:oracle:applications_platform_engineering:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle applications Platform Engineering
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Applications Platform Engineering
Oracle Corporation Oracle Applications Platform Engineering
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:22:25.066Z

Reserved: 2026-08-04T22:06:34.597Z

Link: CVE-2026-70795

cve-icon Vulnrichment

Updated: 2026-08-24T15:12:50.372Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:33.387

Modified: 2026-08-28T17:35:10.517

Link: CVE-2026-70795

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:32:15Z

Weaknesses