cve-2026-70812

{
  "cve": "CVE-2026-70812",
  "enrichment": {
    "affected": [
      {
        "configurations": [
          {
            "platform": null,
            "status": "affected",
            "versions": {
              "scheme": "semver",
              "value": "[12.2.3,12.2.15]"
            }
          }
        ],
        "enrichment": {
          "confidence": 95.0,
          "confidence_source": "inferred",
          "scores": [
            {
              "score": 95.0,
              "source": "inferred"
            },
            {
              "score": 100.0,
              "source": "matching"
            }
          ]
        },
        "original": {
          "product": "Oracle Call Center Technology",
          "source": "cna",
          "vendor": "Oracle Corporation"
        },
        "product": "call_center_technology",
        "vendor": "oracle"
      }
    ],
    "created": "2026-08-19T10:00:05.008362+00:00",
    "title": "Low‑Privileged HTTP Exploit Allows Compromise of Oracle Call Center Technology",
    "updated": "2026-08-24T22:00:04.881814+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$call_center_technology"
    ]
  },
  "epss": {
    "score": 0.00432
  },
  "mitre": {
    "cpes": [
      "cpe:2.3:a:oracle:call_center_technology:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-08-18T21:01:57.005000+00:00",
    "description": "Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "mitre_repo_path": "cves/2026/70xxx/CVE-2026-70812.json",
    "references": [
      "https://www.oracle.com/security-alerts/cspuaug2026.html"
    ],
    "title": null,
    "updated": "2026-08-24T15:22:12.040000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$call_center_technology"
    ],
    "weaknesses": []
  },
  "nvd": {
    "cpes": [
      "cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*"
    ],
    "created": "2026-08-18T21:17:35.793000+00:00",
    "description": "Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {
        "score": 8.8,
        "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
      },
      "cvssV4_0": {}
    },
    "nvd_repo_path": "2026/CVE-2026-70812.json",
    "references": [
      "https://www.oracle.com/security-alerts/cspuaug2026.html"
    ],
    "title": null,
    "updated": "2026-08-27T18:31:07.680000+00:00",
    "vendors": [
      "oracle",
      "oracle$PRODUCT$e-business_suite"
    ],
    "weaknesses": [
      "CWE-284"
    ]
  },
  "opencve": {
    "changes": [
      {
        "created": "2026-08-18T21:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
              "old": null
            },
            "type": "description"
          },
          {
            "details": [
              "oracle",
              "oracle$PRODUCT$call_center_technology"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:call_center_technology:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle",
                "oracle$PRODUCT$call_center_technology"
              ],
              "removed": []
            },
            "type": "vendors"
          },
          {
            "details": {
              "added": [
                "https://www.oracle.com/security-alerts/cspuaug2026.html"
              ],
              "removed": []
            },
            "type": "references"
          },
          {
            "details": {
              "added": {
                "cvssV3_1": {
                  "score": 8.8,
                  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "a015ab2c-09e6-42aa-840c-247e3bbde80c"
      },
      {
        "created": "2026-08-19T10:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Remote Service Takeover via Unauthenticated HTTP Access in Oracle Call Center Technology",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-286",
                "CWE-307"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "6652a186-4686-4504-8dbd-dc244b361b14"
      },
      {
        "created": "2026-08-21T06:30:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Remote Service Takeover via Unauthenticated HTTP Access in Oracle Call Center Technology"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-286",
                "CWE-307"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "561d85ff-323c-4f4f-8da0-d1729dff6fec"
      },
      {
        "created": "2026-08-21T08:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Authentication/Authorization Flaw Allowing Remote Service Takeover in Oracle Call Center Technology",
              "old": null
            },
            "type": "title"
          },
          {
            "details": {
              "added": [
                "CWE-285"
              ],
              "removed": []
            },
            "type": "weaknesses"
          }
        ],
        "id": "a5c1763a-a156-4425-87c9-20cc42e1f0d2"
      },
      {
        "created": "2026-08-24T16:30:00+00:00",
        "data": [
          {
            "details": {
              "added": [
                "CWE-284"
              ],
              "removed": []
            },
            "type": "weaknesses"
          },
          {
            "details": {
              "added": {
                "ssvc": {
                  "options": {
                    "Automatable": "no",
                    "Exploitation": "none",
                    "Technical Impact": "total"
                  },
                  "version": "2.0.3"
                }
              },
              "removed": {},
              "updated": {}
            },
            "type": "metrics"
          }
        ],
        "id": "2e06c47b-aa13-48cf-b75d-ef9f23034f6c"
      },
      {
        "created": "2026-08-24T19:00:00+00:00",
        "data": [
          {
            "details": {
              "new": null,
              "old": "Authentication/Authorization Flaw Allowing Remote Service Takeover in Oracle Call Center Technology"
            },
            "type": "title"
          },
          {
            "details": {
              "added": [],
              "removed": [
                "CWE-285"
              ]
            },
            "type": "weaknesses"
          }
        ],
        "id": "e9430a97-c42a-42b6-8a18-6fb27cc67285"
      },
      {
        "created": "2026-08-24T22:15:00+00:00",
        "data": [
          {
            "details": {
              "new": "Low‑Privileged HTTP Exploit Allows Compromise of Oracle Call Center Technology",
              "old": null
            },
            "type": "title"
          }
        ],
        "id": "544e6689-6101-489b-ba62-298c378ee92d"
      },
      {
        "created": "2026-08-27T18:00:00+00:00",
        "data": [
          {
            "details": [
              "oracle$PRODUCT$e-business_suite"
            ],
            "type": "first_time"
          },
          {
            "details": {
              "added": [
                "cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*"
              ],
              "removed": []
            },
            "type": "cpes"
          },
          {
            "details": {
              "added": [
                "oracle$PRODUCT$e-business_suite"
              ],
              "removed": []
            },
            "type": "vendors"
          }
        ],
        "id": "b96aa5c7-d993-4177-a128-d0849f124992"
      }
    ],
    "cpes": {
      "data": [
        "cpe:2.3:a:oracle:call_center_technology:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "created": {
      "data": "2026-08-18T21:01:57.005000+00:00",
      "provider": "mitre"
    },
    "description": {
      "data": "Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
      "provider": "mitre"
    },
    "metrics": {
      "cvssV2_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_0": {
        "data": {},
        "provider": null
      },
      "cvssV3_1": {
        "data": {
          "score": 8.8,
          "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        },
        "provider": "mitre"
      },
      "cvssV4_0": {
        "data": {},
        "provider": null
      },
      "epss": {
        "data": {
          "score": 0.00432
        },
        "provider": "first"
      },
      "kev": {
        "data": {},
        "provider": null
      },
      "ssvc": {
        "data": {
          "options": {
            "Automatable": "no",
            "Exploitation": "none",
            "Technical Impact": "total"
          },
          "version": "2.0.3"
        },
        "provider": "vulnrichment"
      },
      "threat_severity": {
        "data": null,
        "provider": null
      }
    },
    "references": {
      "data": [
        "https://www.oracle.com/security-alerts/cspuaug2026.html"
      ],
      "providers": [
        "mitre",
        "nvd"
      ]
    },
    "title": {
      "data": "Low‑Privileged HTTP Exploit Allows Compromise of Oracle Call Center Technology",
      "provider": "enrichment"
    },
    "updated": {
      "data": "2026-08-27T18:31:07.680000+00:00",
      "provider": "nvd"
    },
    "vendors": {
      "data": [
        "oracle",
        "oracle$PRODUCT$call_center_technology",
        "oracle$PRODUCT$e-business_suite"
      ],
      "providers": [
        "mitre",
        "nvd",
        "enrichment"
      ]
    },
    "weaknesses": {
      "data": [
        "CWE-284"
      ],
      "providers": [
        "nvd",
        "vulnrichment"
      ]
    }
  },
  "vulnrichment": {
    "cpes": [],
    "created": "2026-08-18T21:01:57.005000+00:00",
    "description": "Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center Technology.  Successful attacks of this vulnerability can result in takeover of Oracle Call Center Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).",
    "metrics": {
      "cvssV2_0": {},
      "cvssV3_0": {},
      "cvssV3_1": {},
      "cvssV4_0": {},
      "kev": {},
      "ssvc": {
        "options": {
          "Automatable": "no",
          "Exploitation": "none",
          "Technical Impact": "total"
        },
        "version": "2.0.3"
      }
    },
    "references": [],
    "title": null,
    "updated": "2026-08-24T15:12:47.923000+00:00",
    "vendors": [],
    "vulnrichment_repo_path": "2026/70xxx/CVE-2026-70812.json",
    "weaknesses": [
      "CWE-284"
    ]
  }
}