Description
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data as well as unauthorized update, insert or delete access to some of Oracle Scripting accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-08-18
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Scripting, part of Oracle E-Business Suite, contains a vulnerability that allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data and, in some cases, to insert, update, or delete data. The weakness permits breaches of confidentiality and limited integrity, enabling the attacker to view or modify data that they should not have permission to access.

Affected Systems

Oracle Scripting is affected in Oracle E-Business Suite versions 12.2.3 through 12.2.15, specifically within the Internal Operations component. Only these versions and that component are listed as vulnerable.

Risk and Exploitability

The CVSS 3.1 score of 7.1 points to a high impact vulnerability. Attackers require only local or low privileges and network connectivity over HTTP, making exploitation relatively straightforward. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, but the combination of high CVSS and network reachability still represents a significant risk. A successful exploit grants the attacker unauthorized read or modify access to all data exposed by Oracle Scripting.

Generated by OpenCVE AI on August 21, 2026 at 05:13 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor’s official patch for Oracle Scripting when it becomes available
  • Restrict HTTP access to Oracle Scripting to trusted networks or VPNs and block exposure to the public internet
  • Enforce strict access controls and regularly monitor audit logs for unauthorized access attempts

Generated by OpenCVE AI on August 21, 2026 at 05:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 05:30:00 +0000

Type Values Removed Values Added
Title Oracle Scripting Unauthorized Data Access via Low-Privilege HTTP Attack

Wed, 19 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
Title Oracle Scripting Unauthorized Data Access via Low-Privilege HTTP Attack
Weaknesses CWE-284
CWE-287

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data as well as unauthorized update, insert or delete access to some of Oracle Scripting accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle scripting
CPEs cpe:2.3:a:oracle:scripting:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle scripting
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle Scripting
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T16:13:40.899Z

Reserved: 2026-08-04T22:06:34.598Z

Link: CVE-2026-70808

cve-icon Vulnrichment

Updated: 2026-08-24T16:13:37.290Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:35.247

Modified: 2026-08-28T14:48:30.050

Link: CVE-2026-70808

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T05:15:05Z

Weaknesses