Description
Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Loans accessible data as well as unauthorized update, insert or delete access to some of Oracle Loans accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Published: 2026-08-18
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A low privileged attacker who can reach the system over HTTP can exploit a weakness in the Oracle Loans component of Oracle E‑Business Suite to gain unauthorized access to critical data and alter or delete it. The vulnerability can lead to data confidentiality breaches and integrity violations throughout the Oracle Loans application. It does not affect system availability.

Affected Systems

Oracle Loans, a component of Oracle E‑Business Suite, is affected in versions 12.2.3 through 12.2.15. The flaw resides in the Internal Operations area and is reachable via standard HTTP traffic.

Risk and Exploitability

The CVSS base score of 7.1 indicates a high risk, especially given the low attack complexity and low privilege requirement. While the EPSS score is <1%, indicating a very low exploitation probability, the direct HTTP access vector suggests a readily exploitable route. The vulnerability is not listed in CISA’s KEV catalog at present, but it remains a significant threat to confidentiality and integrity for any organization running the affected Oracle Loans versions.

Generated by OpenCVE AI on August 21, 2026 at 04:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor patches or updates that fix the internal operations access control flaw
  • Restrict HTTP traffic to the Oracle Loans endpoints using firewalls or VPNs, allowing only trusted IP ranges
  • Enforce strong authentication and authorization controls for all internal operations interfaces

Generated by OpenCVE AI on August 21, 2026 at 04:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle e-business Suite
CPEs cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:loans:-:*:*:*:*:*:*:*
Vendors & Products Oracle e-business Suite

Mon, 24 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 05:15:00 +0000

Type Values Removed Values Added
Title Low Privilege HTTP Access Allows Unauthorized Data Modification in Oracle Loans
Weaknesses CWE-284
CWE-862

Wed, 19 Aug 2026 13:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Modification via Low‑Privilege HTTP Attack in Oracle Loans
Weaknesses CWE-284
CWE-862

Wed, 19 Aug 2026 03:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Access and Modification via Low‑Privilege HTTP Attack in Oracle Loans
Weaknesses CWE-284
CWE-862

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Loans. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Loans accessible data as well as unauthorized update, insert or delete access to some of Oracle Loans accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
First Time appeared Oracle
Oracle loans
CPEs cpe:2.3:a:oracle:loans:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle loans
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'}

Subscriptions

Oracle E-business Suite Loans
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-24T15:20:14.685Z

Reserved: 2026-08-04T22:06:34.601Z

Link: CVE-2026-70844

cve-icon Vulnrichment

Updated: 2026-08-24T15:20:05.505Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:40.153

Modified: 2026-08-28T14:45:47.513

Link: CVE-2026-70844

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T05:00:13Z

Weaknesses