What is the CVSS score of CVE-2026-70687?

CVE-2026-70687 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Marketing are affected by CVE-2026-70687?

Oracle Marketing versions 12.2.3 through 12.2.15 contain an authentication bypass vulnerability allowing users with basic system privileges to access all confidential data within the marketing…

How to fix or mitigate CVE-2026-70687?

Within 24 hours, identify all systems running Oracle Marketing 12.2.3 through 12.2.15 and audit network access to the Audience component; restrict HTTP access to the Audience component and enable detailed logging of authentication and data access attempts. Within 7 days, implement network segmentation isolating Oracle Marketing from untrusted networks, conduct access reviews of all low-privilege accounts with Marketing permissions, and deploy web application firewall rules to detect exploitation patterns. Within 30 days, evaluate and execute migration to Oracle Marketing versions outside the 12.2.3-12.2.15 range, establish daily monitoring of vendor security advisories, and complete forensic analysis of access logs to identify any unauthorized activity.

Oracle Marketing CVE-2026-70687

EUVD-2026-61642 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-fchh-8qvv-xq35

Authentication Bypass Oracle Marketing

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable via HTTP with only a low-privileged account; scope change confirmed by cross-product data access; no integrity or availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 19, 2026 - 00:16 vuln.today

CVE Published

Aug 18, 2026 - 21:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Marketing. While the vulnerability is in Oracle Marketing, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Marketing accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Marketing 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker to fully compromise confidentiality of all Oracle Marketing-accessible data via the Audience component over HTTP. The vulnerability carries a scope change, meaning successful exploitation can ripple into additional Oracle E-Business Suite products beyond Marketing itself. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Persist

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privileged account on the Oracle E-Business Suite instance with network HTTP access - this is the baseline condition per the CVSS vector (PR:L, AV:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.7 reflects a credible, network-exploitable confidentiality threat with a scope change - meaning blast radius extends beyond the directly vulnerable component. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply Oracle's Critical Patch Update (CPU) for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Oracle Marketing 12.2.3 through 12.2.15 and audit network access to the Audience component; restrict HTTP access to the Audience component and enable detailed logging of authentication and data access attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.