{
  "cve": "CVE-2026-70781",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[12.2.3,12.2.15]"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Oracle Proposals",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "proposals",
        "vendor": "oracle"
      }
    ],
    "created": "2026-08-19T03:00:07.141768+00:00",
    "title": "High-Privilege HTTP Vulnerability in Oracle Proposals Enabling Full Takeover",
    "updated": "2026-08-21T06:15:03.993531+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$proposals"
    ],
    "weaknesses": [
      "CWE-284",
      "CWE-94"
    ]
  },
  "epss": {
    "score": 0.00486
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:proposals:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-08-18T21:01:30.448000+00:00",
    "description": "Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals.  Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.2,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/70xxx/CVE-2026-70781.json",
    "references": [
      "https://www.oracle.com/security-alerts/cspuaug2026.html"
    ],
    "title": null,
    "updated": "2026-08-25T15:08:32.950000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$proposals"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:proposals:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-08-18T21:17:31.370000+00:00",
    "description": "Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals.  Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 7.2,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-70781.json",
    "references": [
      "https://www.oracle.com/security-alerts/cspuaug2026.html"
    ],
    "title": null,
    "updated": "2026-08-28T18:27:13.520000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$proposals"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-08-18T21:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals.  Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$proposals"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:proposals:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$proposals"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cspuaug2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 7.2,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "8955cd36-752c-490a-bab8-590773fd4511"
      },
      {
        "created": "2026-08-19T03:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Remote HTTP Exploit Compromise of Oracle Proposals Leading to Full Takeover",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-269",
                "CWE-285"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "57919676-2505-435d-8dbe-9be39c2973ed"
      },
      {
        "created": "2026-08-19T13:00:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Remote HTTP Exploit Compromise of Oracle Proposals Leading to Full Takeover"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-269",
                "CWE-285"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "4cefc5f5-c4ee-4805-9175-012acaabfedc"
      },
      {
        "created": "2026-08-21T06:30:00+00:00",
        "data": [
          {
            "details": {
              "new": "High-Privilege HTTP Vulnerability in Oracle Proposals Enabling Full Takeover",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-284",
                "CWE-94"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "d88b491c-ceb8-4d4b-bba7-dd680cdd6ad9"
      },
      {
        "created": "2026-08-25T15:30:00+00:00",
        "data": [
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "8ae70878-2a63-400a-9985-2f7b4a57c4dd"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:proposals:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-08-18T21:01:30.448000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals.  Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 7.2,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00486
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cspuaug2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "High-Privilege HTTP Vulnerability in Oracle Proposals Enabling Full Takeover",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-08-25T15:16:40.807000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$proposals"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284",
        "CWE-94"
      ],
      "providers": [
        "nvd",
        "vulnrichment",
        "enrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-08-18T21:01:30.448000+00:00",
    "description": "Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Proposals.  Successful attacks of this vulnerability can result in takeover of Oracle Proposals. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-08-25T15:06:43.176000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/70xxx/CVE-2026-70781.json",
    "weaknesses": [
      "CWE-284"
    ]
  }
}