EUVD-2026-61673
GHSA-cj3f-xwr7-2qr7
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Network HTTP delivery, low-privilege auth required, Oracle-confirmed difficult exploitation (AC:H), and cross-component scope change with full CIA impact independently align with the provided vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. While the vulnerability is in Oracle Bills of Material, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Bills of Material. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Full system compromise of Oracle Bills of Material - a component of Oracle E-Business Suite - across versions 12.2.3 through 12.2.15 is achievable by a network-reachable, low-privileged attacker via crafted HTTP requests, with Oracle confirming potential for complete takeover covering confidentiality, integrity, and availability. The scope change designation in the CVSS vector indicates that successful exploitation can cascade beyond the Bills of Material module to affect additional Oracle E-Business Suite components. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) network connectivity to the Oracle E-Business Suite HTTP web tier - attacks are delivered remotely over the network, not requiring local system access; (2) a valid, low-privileged authenticated account within the EBS environment (PR:L per the CVSS vector), meaning the attacker must already possess or have stolen credentials granting basic EBS access; (3) successful satisfaction of a high-complexity exploitation condition (AC:H), which Oracle characterizes as 'difficult to exploit' - this likely involves specific application state, timing, or non-obvious request sequencing within the Internal Operations component that is not publicly disclosed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.5 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a high-severity vulnerability with meaningful exploitation friction: while network-reachable and requiring only low-level privilege, the AC:H rating signals that reliable exploitation demands precise conditions - such as race conditions, specific application state, or non-trivial knowledge of internal logic - that are not easily replicated by automated scanners or unsophisticated actors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Patch Update, available through https://www.oracle.com/security-alerts/cspuaug2026.html, which directly addresses CVE-2026-70718. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle E-Business Suite deployments running versions 12.2.3-12.2.15 and assess network accessibility of each instance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bills Of Material
View allData compromise in Oracle Bills of Material (Internal Operations component) of Oracle E-Business Suite versions 12.2.13
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Bill Issues). Rated high se
Account/component takeover in Oracle Bills of Material (component: Internal Operations) within Oracle E-Business Suite 1
Oracle Bills of Material's Web Services component in E-Business Suite 12.2.3-12.2.15 exposes a medium-severity flaw allo
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today