CVE-2026-70833 in Landed Cost Management
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Landed Cost Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Landed Cost Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Landed Cost Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Landed Cost Management component of Oracle E-Business Suite, specifically affecting internal operations across supported versions ranging from 12.2.3 to 12.2.15. This security flaw represents a significant risk to organizations relying on this enterprise resource planning module for managing supply chain costs and financial data integrity. The core technical issue stems from an insufficient access control mechanism within the application's internal operations layer, which fails to properly enforce authorization checks before processing user requests. Consequently, the system does not adequately distinguish between privileged administrative actions and standard operational queries when handling HTTP-based interactions. This architectural weakness allows a low-privileged attacker who has established network connectivity via HTTP to bypass intended security boundaries and execute commands or access data that should be restricted to higher-level users with elevated privileges.
From an exploitation perspective, the vulnerability is characterized by its ease of use and broad accessibility requirements. An attacker does not need complex social engineering tactics or user interaction such as clicking a malicious link, nor do they require high-level authentication credentials initially. Instead, any authenticated low-privileged user on the network can leverage this flaw to compromise the integrity and confidentiality of the system's data stores. The attack vector is classified as Network (AV:N) with Low Complexity (AC:L), indicating that standard networking knowledge and basic scripting capabilities are sufficient to exploit the defect. Since no user interaction is required (UI:N), automated exploitation tools could potentially be developed to scan for this vulnerability across multiple instances, increasing the likelihood of widespread compromise in environments where patching has not been promptly applied.
The operational impact of successfully exploiting this vulnerability is severe, as indicated by a CVSS 3.1 Base Score of 7.1, which denotes a High severity rating. The primary impacts are on Confidentiality and Integrity, with no direct effect on Availability (A:N). Successful exploitation enables an attacker to gain unauthorized access to critical business data within the Landed Cost Management module. This includes sensitive financial records, supplier contracts, cost allocation details, and inventory valuation metrics that are essential for accurate financial reporting and regulatory compliance. Furthermore, the vulnerability permits unauthorized modifications to this data, allowing attackers to insert false transactions, update existing records to manipulate profit margins or tax liabilities, or delete critical historical data. Such integrity violations can lead to significant financial discrepancies, audit failures, and potential legal consequences due to inaccurate financial statements.
In terms of industry standard classifications, this vulnerability aligns with CWE-269: Improper Privilege Management, as the core failure lies in the system's inability to enforce appropriate access levels for different user roles. It also relates closely to CWE-862: Missing Authorization, where the application fails to verify that a user has permission to perform an action on a specific resource before executing it. From a tactical perspective within the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Privilege Escalation techniques. Attackers can use this flaw to move laterally through the network by leveraging compromised low-privileged accounts to access more sensitive data stores or modify configurations that could lead to further system compromise. The ability to alter financial data also touches upon tactics related to Data Manipulation, which is critical for maintaining trust in enterprise systems.
To mitigate this risk, organizations must prioritize applying the latest security patches provided by Oracle for their specific version of E-Business Suite. It is crucial to verify that all instances running versions 12.2.3 through 12.2.15 are updated to a patched release where these access control checks have been reinforced. In addition to patching, implementing strict network segmentation can help limit exposure by ensuring that only authorized systems and users can reach the HTTP endpoints associated with Landed Cost Management operations. Deploying Web Application Firewalls (WAFs) configured with rulesets designed to detect anomalous request patterns or unauthorized API calls may provide an additional layer of defense against exploitation attempts while patches are being deployed. Regular audits of user privileges should also be conducted to ensure that low-privileged accounts do not possess unnecessary access rights, thereby reducing the attack surface available to potential intruders who might leverage this vulnerability for further malicious activities.