{ "cve": "CVE-2026-70773", "enrichment": { "affected": [ { "configurations": [ { "platform": null, "status": "affected", "versions": { "scheme": "semver", "value": "[12.2.3,12.2.15]" } } ], "enrichment": { "confidence": 95.0, "confidence_source": "inferred", "scores": [ { "score": 95.0, "source": "inferred" }, { "score": 100.0, "source": "matching" } ] }, "original": { "product": "Oracle HCM Common Architecture", "source": "cna", "vendor": "Oracle Corporation" }, "product": "hcm_common_architecture", "vendor": "oracle" } ], "created": "2026-08-19T10:00:05.017583+00:00", "title": "Unauthenticated HTTP Access to Oracle HCM Common Architecture Allows Unauthorized Data Access", "updated": "2026-08-24T23:30:17.081082+00:00", "vendors": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ] }, "epss": { "score": 0.00353 }, "mitre": { "cpes": [ "cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*" ], "created": "2026-08-18T21:01:27.814000+00:00", "description": "Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 8.2, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" }, "cvssV4_0": {} }, "mitre_repo_path": "cves/2026/70xxx/CVE-2026-70773.json", "references": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "title": null, "updated": "2026-08-24T14:23:49.862000+00:00", "vendors": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ], "weaknesses": [] }, "nvd": { "cpes": [ "cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*" ], "created": "2026-08-18T21:17:30.173000+00:00", "description": "Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": { "score": 8.2, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" }, "cvssV4_0": {} }, "nvd_repo_path": "2026/CVE-2026-70773.json", "references": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "title": null, "updated": "2026-09-03T16:15:07.217000+00:00", "vendors": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ], "weaknesses": [ "CWE-284" ] }, "opencve": { "changes": [ { "created": "2026-08-18T21:15:00+00:00", "data": [ { "details": { "new": "Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).", "old": null }, "type": "description" }, { "details": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ], "type": "first_time" }, { "details": { "added": [ "cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*" ], "removed": [] }, "type": "cpes" }, { "details": { "added": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ], "removed": [] }, "type": "vendors" }, { "details": { "added": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "removed": [] }, "type": "references" }, { "details": { "added": { "cvssV3_1": { "score": 8.2, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "a36e8dc1-2f38-473e-ac98-1341fa7714ac" }, { "created": "2026-08-19T10:15:00+00:00", "data": [ { "details": { "new": "Unauthenticated Remote Access in Oracle HCM Common Architecture", "old": null }, "type": "title" }, { "details": { "added": [ "CWE-284", "CWE-287" ], "removed": [] }, "type": "weaknesses" } ], "id": "ae56aec5-30ad-4fb4-95b0-f60cbf9c92e9" }, { "created": "2026-08-21T06:30:00+00:00", "data": [ { "details": { "new": null, "old": "Unauthenticated Remote Access in Oracle HCM Common Architecture" }, "type": "title" }, { "details": { "added": [], "removed": [ "CWE-284", "CWE-287" ] }, "type": "weaknesses" } ], "id": "09108c5f-2cb1-4c4d-84dc-3ecbbd6fb0fc" }, { "created": "2026-08-21T08:15:00+00:00", "data": [ { "details": { "new": "Unauthenticated HTTP Access Allows Data Compromise in Oracle HCM Common Architecture", "old": null }, "type": "title" }, { "details": { "added": [ "CWE-200", "CWE-285" ], "removed": [] }, "type": "weaknesses" } ], "id": "37589bc9-d0f1-4139-b8de-111df6b0fa0c" }, { "created": "2026-08-24T15:30:00+00:00", "data": [ { "details": { "added": [ "CWE-284" ], "removed": [] }, "type": "weaknesses" }, { "details": { "added": { "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "removed": {}, "updated": {} }, "type": "metrics" } ], "id": "4088d3a2-67e2-4f05-8ace-0a82775dcd4b" }, { "created": "2026-08-24T22:30:00+00:00", "data": [ { "details": { "new": null, "old": "Unauthenticated HTTP Access Allows Data Compromise in Oracle HCM Common Architecture" }, "type": "title" }, { "details": { "added": [], "removed": [ "CWE-200", "CWE-285" ] }, "type": "weaknesses" } ], "id": "77819d25-3b51-4fa9-8376-8cf339b0f7a1" }, { "created": "2026-08-24T23:45:00+00:00", "data": [ { "details": { "new": "Unauthenticated HTTP Access to Oracle HCM Common Architecture Allows Unauthorized Data Access", "old": null }, "type": "title" } ], "id": "5208816f-acf7-4f33-9aa9-bc2d7c47eec6" } ], "cpes": { "data": [ "cpe:2.3:a:oracle:hcm_common_architecture:*:*:*:*:*:*:*:*" ], "providers": [ "mitre", "nvd" ] }, "created": { "data": "2026-08-18T21:01:27.814000+00:00", "provider": "mitre" }, "description": { "data": "Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).", "provider": "mitre" }, "metrics": { "cvssV2_0": { "data": {}, "provider": null }, "cvssV3_0": { "data": {}, "provider": null }, "cvssV3_1": { "data": { "score": 8.2, "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N" }, "provider": "mitre" }, "cvssV4_0": { "data": {}, "provider": null }, "epss": { "data": { "score": 0.00353 }, "provider": "first" }, "kev": { "data": {}, "provider": null }, "ssvc": { "data": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" }, "provider": "vulnrichment" }, "threat_severity": { "data": null, "provider": null } }, "references": { "data": [ "https://www.oracle.com/security-alerts/cspuaug2026.html" ], "providers": [ "mitre", "nvd" ] }, "title": { "data": "Unauthenticated HTTP Access to Oracle HCM Common Architecture Allows Unauthorized Data Access", "provider": "enrichment" }, "updated": { "data": "2026-08-24T23:30:17.081082+00:00", "provider": "enrichment" }, "vendors": { "data": [ "oracle", "oracle$PRODUCT$hcm_common_architecture" ], "providers": [ "mitre", "nvd", "enrichment" ] }, "weaknesses": { "data": [ "CWE-284" ], "providers": [ "nvd", "vulnrichment" ] } }, "vulnrichment": { "cpes": [], "created": "2026-08-18T21:01:27.814000+00:00", "description": "Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HCM Common Architecture. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HCM Common Architecture accessible data as well as unauthorized update, insert or delete access to some of Oracle HCM Common Architecture accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).", "metrics": { "cvssV2_0": {}, "cvssV3_0": {}, "cvssV3_1": {}, "cvssV4_0": {}, "kev": {}, "ssvc": { "options": { "Automatable": "yes", "Exploitation": "none", "Technical Impact": "partial" }, "version": "2.0.3" } }, "references": [], "title": null, "updated": "2026-08-24T13:30:26.741000+00:00", "vendors": [], "vulnrichment_repo_path": "2026/70xxx/CVE-2026-70773.json", "weaknesses": [ "CWE-284" ] } }