CVE-2026-70774

CVE Enrichment

CVSS: 7.1 HIGH
EPSS: 0.34%
EPSS Percentile: 26.05%
CISA KEV: Not listed

Description

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Warehouse Management. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Warehouse Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Warehouse Management. CVSS 3.1 Base Score 7.1 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L).

Technical Details

CVSS Version: 3.1
CNA / NVD Source: secalert_us@oracle.com
Published: 19-Aug-2026 04:17
Last Modified: 24-Aug-2026 22:50
EPSS Date: 2026-10-20
CWE: CWE-284

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:N /
                            I:H /
                            A:L

Affected Products / Versions

oracle / warehouse_management
Version / affected range: * · from (inclusive) 12.2.3 · through (inclusive) 12.2.15
cpe:2.3:a:oracle:warehouse_management:*:*:*:*:*:*:*:*

References

secalert_us@oracle.com

Last enrichment sync: 21-Oct-2026 05:43
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

A recent example is CVE-2026-70774 in Oracle Warehouse Management, part of Oracle E-Business Suite. Warehouse Attack Paths Link Scanners, Printers and WMS to Operational Disruption

CVE (1)

MITRE ATT&CK (3)

Vendors (2)

Products (4)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.