CVE-2026-70810 in Scripting
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Scripting component of Oracle E-Business Suite, specifically affecting internal operations across supported versions ranging from 12.2.3 to 12.2.15. This security flaw is classified as a critical information disclosure issue that stems from improper access control mechanisms inherent in how the scripting engine handles incoming requests. The core technical deficiency lies in the failure of the application to adequately verify authentication credentials or session validity before processing sensitive internal operations. Consequently, an attacker who possesses network connectivity to the affected system can interact with the vulnerable endpoints without needing valid user accounts or prior authentication steps. This lack of enforcement allows for direct exploitation over standard HTTP protocols, bypassing traditional perimeter defenses that rely on identity verification as a primary security control.
From an operational perspective, the impact of this vulnerability is severe due to its high confidentiality implications. A successful exploit enables an unauthenticated remote attacker to access critical data stored within the Oracle Scripting environment. This includes sensitive business logic, configuration details, and potentially proprietary information processed by the scripting engine. The CVSS 3.1 base score of 7.5 reflects this significant risk, primarily driven by the high impact on confidentiality while maintaining low complexity for exploitation. Attackers do not require user interaction or complex setup procedures to leverage this flaw, making it a prime target for automated scanning tools and opportunistic attacks against exposed web services. The ability to retrieve all accessible data within the scope of Oracle Scripting means that even partial access can lead to substantial intellectual property theft or competitive disadvantage for organizations relying on these systems for core business operations.
In terms of industry standard classifications, this vulnerability aligns with CWE-287, which denotes Improper Authentication, and specifically relates to weaknesses in verifying identity before granting access to resources. It also maps to the MITRE ATT&CK framework under techniques associated with Initial Access and Discovery, where adversaries exploit misconfigured services to gather intelligence or gain a foothold within an enterprise network. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N clearly indicates that the attack is remote, requires low complexity, has no prerequisites for privileges, involves no user interaction, and results in high confidentiality impact with no effect on integrity or availability. This profile underscores the urgency of remediation as the barrier to entry is minimal while the potential damage is substantial.
To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle that address the authentication checks within the Internal Operations component of Oracle Scripting. It is imperative to verify that all instances running versions 12.2.3 through 12.2.15 are updated to a version where these access control flaws have been resolved. In addition to patching, implementing network-level controls such as Web Application Firewalls can provide an additional layer of defense by filtering out malicious requests targeting known vulnerable endpoints before they reach the application server. Regular audits of authentication mechanisms and strict adherence to least privilege principles for service accounts will further reduce the attack surface. Continuous monitoring for anomalous access patterns related to scripting operations should also be established to detect any potential exploitation attempts in real time, ensuring that security posture remains robust against evolving threats targeting enterprise resource planning systems.