CVE-2026-70721

Oracle Hyperion Profitability and Cost Management 11.2.25.0.000 (Deployment component) is affected by a HIGH-severity CVSS 8.6 unauthenticated HTTP-based vulnerability allowing unauthorized access to all product data with scope change; Oracle's CSPU Aug 2026 advisory is the primary reference. No ...

CVE-2026-70719

Oracle Hyperion Calculation Manager 11.2.25.0.000 has a Security component flaw allowing an unauthenticated local attacker to read a subset of accessible data. CVSS 3.1 scores it MEDIUM (4.0). Oracle's August 2026 CPU advisory is referenced for patch details.

CVE-2026-70720

CVE-2026-70720 affects Oracle E-Business Suite Production Scheduling (Internal Operations component), versions 12.2.3–12.2.15. A low-privileged, network-accessible attacker can exploit it to read all accessible data (CVSS 6.5, confidentiality-only). Oracle released August 2026 CPU patches; apply ...

CVE-2026-70718

CVE-2026-70718 affects the Oracle Bills of Material product (component: Internal Operations) within Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though it is rated as difficult to exploit (high a...

CVE-2026-70716

Oracle Helidon 4.5.0's Imperative Web Server component is vulnerable to a difficult-to-exploit, unauthenticated HTTP-based attack allowing integrity compromise (CVSS 5.9). No root cause, exploit code, or patch details are provided in the documents. Monitor Oracle's CSP bulletin for remediation up...

CVE-2026-70715

CVE-2026-70715 affects the Trace File Analyzer component of Oracle Autonomous Health Framework (versions 26 through 26.5.2). An unauthenticated attacker with access to the physical communication segment attached to the hardware where the framework executes can achieve full compromise (confidentia...

CVE-2026-70717

CVE-2026-70717 affects Oracle Autonomous Health Framework's Cluster Health Analyzer component (versions 26.1.0, 26.2.0, 26.3.1, 26.5.0, 26.5.2). A low-privileged attacker with physical segment access can compromise the framework with scope-change impact to other products, causing unauthorized dat...

CVE-2026-70712

CVE-2026-70712 affects the Install component of Oracle Agile Engineering Data Management (Oracle Supply Chain), version 6.2.1 . The vulnerability allows a high-privileged local attacker to achieve full compromise of the product, resulting in complete loss of confidentiality, integrity, and availa...

CVE-2026-70713

Oracle iSetup in E-Business Suite (component: General Ledger Update Transform, Reports) affects versions 12.2.3–12.2.15. A low-privileged network attacker can exploit it via HTTP to fully compromise the application (CVSS 7.5, HIGH). No exploit code or in-the-wild exploitation is reported. Oracle'...

CVE-2026-70714

CVE-2026-70714 affects Oracle Hyperion Calculation Manager version 11.2.25.0.000 in its Security component. A locally authenticated, high-privileged attacker can cause unauthorized creation, deletion, or modification of critical or all accessible data. CVSS 3.1 score is 4.1 (Medium). No exploitat...

CVE-2026-70711

Oracle Hyperion Calculation Manager version 11.2.25.0.000 has a Security-component vulnerability (CVSS 3.6, Low). Exploitation requires local infrastructure access, high complexity, and human interaction, enabling unauthorized read and limited write/delete access to some accessible data. No patch...

CVE-2026-70709

Oracle Agile Engineering Data Management 6.2.1, component Engineering Communication Interface, is vulnerable to a difficult-to-exploit HTTP-based attack requiring no authentication, allowing unauthorized read and limited write access to accessible data (CVSS 4.8, MEDIUM). Oracle's August 2026 CPU...

CVE-2026-70710

CVE-2026-70710 affects the Security API component of Oracle Sales Foundation in Oracle E-Business Suite, versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve full takeover of the Sales Foundation component, resulting in...

CVE-2026-70708

The Security API component of Oracle E-Business Suite Sales Foundation (versions 12.2.3–12.2.15) has a HIGH severity (CVSS 8.1) flaw allowing low-privileged, unauthenticated network attackers to create, delete, or modify critical data and gain full data access. No exploitation evidence is provide...

CVE-2026-70707

Oracle Sales for Handhelds (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3–12.2.15 is vulnerable to a low-complexity network attack requiring only low privileges via HTTP, enabling full product takeover with high confidentiality, integrity, and availability impact (CVS...

CVE-2026-70706

CVE-2026-70706 affects Oracle Sales (Internal Operations) in E-Business Suite versions 12.2.3–12.2.15. A low-privileged, network-accessible attacker can exploit it via HTTP to take over Oracle Sales (CVSS 7.5 HIGH, C/I/A impacts). No exploit code or in-the-wild activity is provided in the documen...

CVE-2026-70705

The affected product is Oracle Hyperion Calculation Manager (Security component), version 11.2.25.0.000. CVSS 3.1 vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N yields a HIGH score of 7.1, reflecting high confidentiality impact with scope change. An unauthenticated attacker with infrastructure-level ...

CVE-2026-70704

Oracle E-Business Suite 12.2.3–12.2.15 Party Search UI has a HIGH-severity (CVSS 8.1) flaw exploitable over HTTP by unauthenticated attackers, enabling full compromise of the Trading Community component. No exploitation evidence is provided. Patch details: Oracle CSP August 2026 advisory. Monitor...

CVE-2026-70703

Oracle Agile Engineering Data Management (Supply Chain, Engineering Communication Interface) version 6.2.1 is affected by a HIGH-severity (CVSS 8.2) network-based flaw allowing low-privileged attackers to gain unauthorized read/write access to critical data; no exploitation or patch details are p...

CVE-2026-70702

Oracle E-Business Suite Payments (File Transmission component) versions 12.2.3–12.2.15 are affected by a high-severity (CVSS 8.2) vulnerability exploitable by unauthenticated attackers over HTTP, enabling unauthorized read of critical data and limited write/delete access. Oracle's August 2026 Cri...