CVE-2026-70805 in Project Planning and Control
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Planning and Control. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Planning and Control accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Planning and Control accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Change Management component of Oracle Project Planning and Control, a critical module within the broader Oracle E-Business Suite ecosystem. This security flaw affects supported software versions ranging from 12.2.3 through 12.2.15. The nature of this defect allows for exploitation by an attacker who possesses only low-level privileges but has network access to the application via HTTP. Unlike vulnerabilities that require complex interaction or user deception, this issue is easily exploitable without any need for user interface manipulation, meaning no human interaction such as clicking a malicious link is required to trigger the exploit. The presence of this flaw in a widely used enterprise resource planning system presents a significant risk to organizations relying on Oracle E-Business Suite for their project management and financial operations.
From a technical perspective, the vulnerability enables unauthorized modifications to critical data within the application environment. Specifically, an attacker can create, delete, or modify sensitive information that is accessible through the Project Planning and Control module. This capability extends beyond mere data alteration; it also grants the ability to access confidential information that should be restricted based on role-based permissions. The attack vector leverages standard HTTP protocols, which are commonly used for web-based interactions with enterprise applications. Because the vulnerability does not require high-level administrative privileges, an attacker who has compromised a low-privileged user account or obtained valid credentials through phishing or credential stuffing can escalate their impact significantly by exploiting this flaw to manipulate data integrity and confidentiality.
The operational impact of this vulnerability is severe, as reflected in its CVSS 3.1 base score of 8.1, which categorizes it as High severity. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates that while availability remains unaffected, both confidentiality and integrity are critically compromised. Unauthorized access to critical data can lead to the exposure of sensitive financial records, project timelines, resource allocations, and contractual details. Furthermore, the ability to modify or delete this data undermines the reliability of business operations, potentially leading to incorrect decision-making based on corrupted datasets. In a regulated industry context, such integrity violations could also result in non-compliance with standards requiring accurate record-keeping and audit trails.
This vulnerability aligns closely with CWE-269, which addresses Improper Privilege Management, as it allows low-privileged users to perform actions that should be restricted or require higher authorization levels. Additionally, the capability to modify critical data maps directly to CWE-74, Injection in Web Applications, if the root cause involves improper sanitization of input parameters sent via HTTP requests. From a tactical standpoint within the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Data Manipulation and potentially Credential Access if used as part of a broader attack chain to maintain persistence or escalate privileges further. The lack of user interaction requirement places it in categories that allow for automated exploitation tools, increasing the likelihood of widespread compromise once discovered by threat actors scanning for vulnerable instances.
To mitigate this risk, organizations must prioritize applying the latest security patches provided by Oracle for their specific version of E-Business Suite. Since supported versions are affected, immediate attention to patch management processes is essential. In addition to software updates, implementing strict network segmentation can limit exposure by ensuring that only authorized systems and users have HTTP access to the Project Planning and Control interface. Deploying Web Application Firewalls with rules tailored to detect injection patterns or unauthorized data modification attempts can provide an additional layer of defense. Regular audits of user privileges should also be conducted to ensure that low-privileged accounts do not possess unnecessary permissions, thereby reducing the attack surface available to potential intruders who may have obtained valid credentials through other means.