CVE-2026-70747 in Customers Online
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers Online. Successful attacks of this vulnerability can result in takeover of Oracle Customers Online. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Customers Online component of the Oracle E-Business Suite, specifically affecting versions ranging from 12.2.3 through 12.2.15. This security flaw is categorized under the Customer Tab functionality and represents a significant risk to organizations relying on this enterprise resource planning platform for customer relationship management operations. The vulnerability allows an attacker with low privileges who has network access via HTTP to compromise the integrity of the application environment. Because the attack vector requires only low-privileged user status, it lowers the barrier to entry significantly compared to vulnerabilities requiring administrative credentials or physical proximity.
From a technical perspective, this flaw enables unauthorized actors to execute actions that should be restricted by role-based access controls. The ability for a low privileged attacker to achieve full takeover of Oracle Customers Online indicates a failure in proper authorization checks within the application logic. This type of defect is commonly associated with insecure direct object references or broken access control mechanisms where the system fails to verify if the authenticated user has sufficient rights to perform specific operations on targeted resources. The exploitation does not require any user interaction, meaning that once an attacker gains low-level network access and valid credentials for a standard account, they can automatically trigger the malicious payload without needing social engineering tactics or clicking deceptive links.
The operational impact of this vulnerability is severe, as reflected by its CVSS 3.1 base score of 8.8, which classifies it as High severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) highlights that the attack has a Network access requirement, Low complexity, and requires only Low privileges with no user interaction required. Crucially, the impact on Confidentiality, Integrity, and Availability is rated as High across all three categories. This means successful exploitation can lead to complete data exfiltration of sensitive customer information, unauthorized modification or deletion of critical business records, and denial of service conditions that disrupt ongoing operations. The compromise effectively results in a total takeover of the Oracle Customers Online instance, allowing attackers to manipulate financial transactions, steal personally identifiable information, or use the system as a pivot point for further lateral movement within the corporate network.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-862 Missing Authorization depending on the specific technical root cause within the Customer Tab codebase. From an adversarial tactics perspective, it maps to MITRE ATT&CK techniques related to Account Manipulation or Access Token Manipulation if privilege escalation occurs post-exploitation, as well as Data Exfiltration over a common network protocol such as HTTP. The lack of user interaction requirement places this firmly in the realm of automated exploitation tools that can scan for and exploit these weaknesses at scale across vulnerable deployments.
Mitigation strategies must prioritize immediate patching to the latest supported version of Oracle E-Business Suite, which includes fixes for this specific vulnerability within the Customer Tab component. Organizations should verify their current version against the affected range of 12.2.3 through 12.2.15 and apply the relevant security patches provided by Oracle as soon as possible. In environments where immediate patching is not feasible due to operational constraints, temporary mitigations should include restricting network access to the E-Business Suite application tier using firewalls or web application firewalls that enforce strict input validation and rate limiting. Additionally, implementing multi-factor authentication for all user accounts can reduce the risk of credential compromise leading to exploitation. Regular audits of user privileges are also recommended to ensure that low-privileged accounts do not possess unnecessary permissions that could be leveraged in conjunction with this vulnerability. Continuous monitoring for anomalous activity within the Customer Tab module will help detect potential exploitation attempts before significant damage occurs.