Is CVE-2026-70945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-70945 being exploited in the wild.

How severe is CVE-2026-70945?

High severity, with a CVSS score of 7.7, published 18 August 2026.

Which products and versions are affected?

Oracle E-Business Suite Payroll 12.2.3 through 12.2.15.

Is there a fix for CVE-2026-70945?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-70945 attacked?

It is attacked over the network.

Am I affected by CVE-2026-70945?

Check whether you run Oracle E-Business Suite Payroll or Oracle Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-70945: Oracle E-Business Suite Payroll unauthorized data access

CVE-2026-70945 · Severity: high · CVSS 7.7 · Published 2026-08-18

Oracle Payroll, a critical financial and HR management system within Oracle E-Business Suite, contains an authentication or authorization vulnerability that allows low-privileged users to access sensitive payroll data. An authenticated attacker with network access can exploit this flaw to view confidential employee and payroll information, potentially affecting other connected enterprise modules due to shared infrastructure.

Technologies: Oracle E-Business Suite Payroll, Oracle Payroll. Vendors: Oracle.

Quick answers

Is CVE-2026-70945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-70945 being exploited in the wild.
How severe is CVE-2026-70945?: High severity, with a CVSS score of 7.7, published 18 August 2026.
Which products and versions are affected?: Oracle E-Business Suite Payroll 12.2.3 through 12.2.15.
Is there a fix for CVE-2026-70945?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-70945 attacked?: It is attacked over the network.
Am I affected by CVE-2026-70945?: Check whether you run Oracle E-Business Suite Payroll or Oracle Payroll at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A network-accessible vulnerability in Oracle Payroll (component: Internal Operations) allows a low-privileged authenticated attacker to bypass authorization controls and access restricted payroll data. The vulnerability has a low attack complexity and requires only valid user credentials and network access via HTTP; no user interaction is needed. Successful exploitation results in high-impact confidentiality breach with no integrity or availability impact, and the scope is changed (impacts systems beyond the Payroll application itself). Patches are available for versions 12.2.3 through 12.2.15.

Affected products

Oracle E-Business Suite Payroll 12.2.3 through 12.2.15

Timeline

2026-08-18: disclosed

References

https://www.oracle.com/security-alerts/cspuaug2026.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.