Oracle Applications DBA CVE-2026-70681

Exploitation requires network access to an Oracle E-Business Suite deployment running Applications DBA versions 12.2.3 through 12.2.15, reachable over HTTP. The most significant prerequisite limiting exploitation is mandatory human interaction (UI:R) - a person other than the attacker must perform an action (such as clicking a link, loading a resource, or submitting a form) that triggers the vulnerable code path; exploitation cannot occur without this step. Additionally, high attack complexity (AC:H) indicates conditions beyond the attacker's control must align, such as a specific application state, race condition, or environmental configuration. No authentication is required from the attacker (PR:N). There is no indication that non-default configuration is required to expose the vulnerable component, but the UI:R and AC:H constraints substantially limit opportunistic or automated mass exploitation.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a meaningful severity, but two factors structurally reduce the likelihood of widespread or automated exploitation: high attack complexity (AC:H) and mandatory user interaction (UI:R). These constraints mean exploitation cannot be fully automated and depends on additional conditions outside attacker control. No EPSS data was supplied, so a quantitative exploitation probability cannot be assessed. The vulnerability is not listed in the CISA KEV catalog, and no proof-of-concept exploit has been identified, consistent with a newly published Oracle CPU issue. The potential impact - full system takeover - is severe if exploited, making this a high-priority item within Oracle CPU remediation cycles for organizations running E-Business Suite. The 'Information Disclosure' tag is inconsistent with the takeover outcome and should not be used to downgrade severity; treat the stated CVSS impact (C:H/I:H/A:H) as the authoritative signal.

An attacker with network access to an Oracle E-Business Suite 12.2.x HTTP interface crafts a malicious HTTP request or embedded resource targeting the JRI or Java utility layer of Oracle Applications DBA. The attacker then induces a legitimate authenticated user - via phishing, CSRF, or a malicious link - to interact with the crafted content, satisfying the UI:R prerequisite. Under the specific conditions required by AC:H, this triggers the vulnerable code path and yields full control over the Applications DBA component. No public proof-of-concept exploit has been identified at time of analysis.