Oracle General Ledger CVE-2026-70686

Exploitation requires a valid low-privileged account on the Oracle E-Business Suite instance (confirmed by PR:L in the vendor-supplied CVSS vector) and HTTP network access to the affected General Ledger Internal Operations component. The vulnerability affects the standard HTTP-exposed application surface with no special non-default configuration documented as a prerequisite. The unscoped impact (S:U) means exploitation is contained to the General Ledger application and does not cascade to the underlying host or adjacent systems. The primary limiting factor is the requirement for at least a low level of authentication - unauthenticated internet-facing exploitation is not indicated by the PR:L vector. Only instances running versions 12.2.3 through 12.2.15 are listed as affected; deployments outside this version range are not confirmed vulnerable.

The CVSS 3.1 score of 8.8 is well-supported by a vector combining network reachability, low attack complexity, and low privilege requirements with full CIA impact - a profile that translates to a realistic, low-barrier exploitation scenario. The vendor's 'Easily exploitable' language reinforces the AC:L/PR:L assessment, meaning any authenticated EBS user, including low-trust service accounts or external portal users, could potentially trigger exploitation without further escalation. No EPSS data was supplied in the available intelligence, and this vulnerability does not appear in the CISA KEV catalog at the time of analysis; however, absence from KEV should not be treated as a reliable safety signal for widely-deployed enterprise ERP software where incident reporting may be delayed. Even a mid-sized municipal IT team in sopot running Oracle EBS for financial management should treat this as urgent given the combination of low exploitation complexity and the vendor's explicit 'takeover' impact descriptor. The absence of a CWE classification is a notable gap: without knowing the root cause class, defenders cannot efficiently identify related exposure points or apply class-level architectural mitigations beyond applying the patch.

An attacker holding a low-privileged Oracle EBS account - such as a junior finance clerk, a compromised batch-processing service account, or a user with minimal portal access - submits a crafted HTTP request targeting the General Ledger Internal Operations component. No additional user interaction, privilege escalation step, or non-default configuration is required prior to exploitation, and the vendor-confirmed low attack complexity suggests the technique is straightforward once the attacker identifies the relevant endpoint. Successful exploitation yields full takeover of the Oracle General Ledger instance, enabling the attacker to read, manipulate, or destroy financial records.