OracleCVE-2026-70930
Oracle Order Management: takeover via Product Diagnostic Tools
High7.5CVE-2026-70930 · Published Aug 18, 2026 · updated Aug 28, 2026
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. Successful attacks of this vulnerability can result in takeover of Oracle Order Management. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Oracle Order Management Product | >= 12.2.3, <= 12.2.15 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-306
More Oracle advisories
All Oracle| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.6 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | Critical9.9 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High8.3 | No fix yet |
| Aug 18 | Helidon: flaw in Imperative Web Server | Medium5.3 | No fix yet |
| Aug 18 | Helidon: data tampering via Imperative Web Server | High7.3 | No fix yet |
| Aug 18 | Helidon: denial of service via Imperative Web Server | High7.5 | No fix yet |