Vulnerability in Oracle Purchasing Product by Oracle
CVE-2026-70798

7.8HIGH

Key Information:

Vendor

Oracle
Status
Oracle Purchasing
Vendor
CVE Published:
18 August 2026

What is CVE-2026-70798?

The vulnerability in Oracle Purchasing, part of the Oracle E-Business Suite, allows an attacker with low privileges to exploit the system. Once logged into the infrastructure, the attacker can take control of Oracle Purchasing, potentially impacting the confidentiality, integrity, and availability of sensitive operational data. The flaw affects multiple versions from 12.2.3 to 12.2.15, emphasizing the need for prompt action by users to mitigate risks. For more information on this issue, refer to the Oracle Advisory.

Affected Version(s)

Oracle Purchasing 12.2.3 <= 12.2.15

References

https://www.oracle.com/security-alerts/cspuaug2026.html
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.