CVE-2026-70747

If you're running Oracle E-Business Suite 12.2.3 through 12.2.15, this CVE demands immediate attention. A low-privilege user can achieve full CIA impact—confidentiality, integrity, and availability—through the Customer Tab component. That's not a theoretical boundary violation; it's a complete system takeover from a starting point of minimal access. The component name 'Customer Tab' is analytically significant. In Oracle EBS architecture, customer-facing tabs are convergence points where backend services, business logic hooks, and data access patterns intersect. This is precisely where authorization breaks down: teams extend these components across years of releases (12.2.3 to 12.2.15 spans over a decade), layering new features onto legacy foundations without consistent access control enforcement. The UI nomenclature 'tab' signals to security reviewers that this is presentation-layer, low-risk—and that classification decision is what allowed the vulnerability to persist. What to check: Identify whether the missing authorization is horizontal (access to other customers' records) or vertical (escalation through internal service calls that execute with elevated context). Either way, the failure indicates the component is routing high-privilege data paths through what was assumed to be a low-risk UI element. Review which backend services the Customer Tab references and audit their authorization enforcement independently—don't assume the patch fixed the underlying integration architecture. The historical pattern is the most concerning element. Oracle EBS has produced at least three CVEs in the past five years (CVE-2019-2888, CVE-2020-2587, CVE-2021-2115) with the same root cause: presentation-layer components exposing service-layer privileges through misclassification. Each individual CVE was patched, but the architectural condition that produces them wasn't catalogued as systemic risk. This suggests other integration points in your EBS environment likely share the same vulnerability pattern—you should audit UI-layer components that interface with elevated-context services, particularly those maintained across multiple release waves without comprehensive access control reviews. Prioritize this based on network exposure. The CVE explicitly states network-accessible exploitation with minimal privilege required. That puts your external-facing EBS interfaces at highest risk. Patch immediately, but treat the patch as symptom remediation—the underlying classification and review process that allowed this needs architectural attention to prevent the next instance in this lineage.

Reviewed through automated stages and approved by a human before publication.