Oracle Applications DBA CVE-2026-70680

Exploitation requires a valid low-privileged Oracle E-Business Suite account (confirmed by PR:L in the CVSS vector), with network access to the application over HTTP. The affected component is 'Internal Operations' within Oracle Applications DBA, and the Oracle advisory describes this as 'easily exploitable,' indicating no unusual or non-default configuration beyond the component being network-reachable is required. Limiting factors include the requirement for a valid authenticated session - unauthenticated external attackers cannot directly exploit this without first obtaining credentials - and the version constraint of EBS 12.2.3 through 12.2.15. There is no indication that elevated EBS roles or AD-specific administrative privileges beyond basic user access are required; however, the Authentication Bypass tag raises the unconfirmed possibility that even the low-privilege requirement may not be enforced correctly.

The CVSS 3.1 base score of 7.1 (High) reflects a network-exploitable vulnerability with low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction (UI:N), and high confidentiality impact alongside low availability impact, with no integrity effect. The absence of a CISA KEV listing and no known public proof-of-concept reduce immediate urgency, but the easily exploitable access profile - any valid low-privileged EBS account over HTTP with no additional preconditions - means the barrier to exploitation is minimal across a very wide affected version range. No EPSS data was provided, so probabilistic prioritization cannot be performed. The 'Authentication Bypass' intelligence tag introduces ambiguity: if the low-privilege requirement is itself bypassable, actual risk would exceed what the CVSS vector represents, though this is not confirmed by available data. For illustrative perspective, even a mid-sized municipal IT department in zabrze running an unpatched EBS 12.2.x instance would face meaningful exposure given the breadth of the affected version range and the low exploitation complexity. The missing CWE classification is a notable gap - without knowing the root cause class, the completeness of the vendor patch cannot be independently verified from external signals.

An attacker holding a low-privileged Oracle E-Business Suite account submits crafted HTTP requests to the Internal Operations interface of the Applications DBA component, bypassing intended authorization controls to read sensitive or all AD-accessible data. The same or a related request sequence triggers a partial denial of service against the AD component, disrupting administrative or patching operations. No public proof-of-concept exists at time of analysis, but the low attack complexity (AC:L) and absence of required user interaction (UI:N) mean exploitation is straightforward once a valid EBS session is obtained.