Oracle Marketing CVE-2026-70687

Exploitation requires a valid low-privileged account on the Oracle E-Business Suite instance with network HTTP access - this is the baseline condition per the CVSS vector (PR:L, AV:N). The vulnerable component is specifically the Audience sub-feature of Oracle Marketing; organizations that have Oracle EBS deployed but have not licensed or activated Oracle Marketing are not exposed. No user interaction from a victim is required (UI:N), and no elevated or administrative privilege is needed beyond a basic authenticated session. Exploitation is limited to: (1) availability of a valid EBS user credential, (2) Oracle Marketing being an active licensed component with the Audience feature in use, and (3) network-layer reachability to the EBS HTTP application tier. The 'Authentication Bypass' tag suggests the flaw may further weaken even the PR:L requirement in practice - this is unconfirmed and should be clarified with Oracle support.

The CVSS 3.1 score of 7.7 reflects a credible, network-exploitable confidentiality threat with a scope change - meaning blast radius extends beyond the directly vulnerable component. The attack vector is network (AV:N), complexity is low (AC:L), and only low privileges are required (PR:L), making exploitation highly accessible to any authenticated EBS user. The complete confidentiality impact (C:H) against both Oracle Marketing data and potentially adjacent EBS products is the primary concern. However, integrity and availability are unaffected (I:N/A:N), limiting the impact to data exfiltration rather than system compromise or disruption. No EPSS data was provided, and the absence of a KEV listing and public POC moderates urgency compared to peer vulnerabilities with identical CVSS scores. The 'Authentication Bypass' tag introduces a nuance: if the bypass reduces the effective privilege requirement below the stated PR:L, real-world exploitability could be higher than the vector suggests - this warrants vendor clarification. Overall, this is a genuine priority for organizations running Oracle EBS with Marketing licensed, particularly where the Audience feature is in active use and where EBS data contains sensitive customer or financial records.

An attacker with a valid low-privileged Oracle EBS account - such as a contractor, read-only business user, or compromised service account - sends crafted HTTP requests to the Oracle Marketing Audience component, triggering an authorization bypass that grants access to confidential marketing data sets, customer records, or audience segmentation data well beyond their assigned permissions. Because the scope change indicator applies, the attacker may leverage the same flaw to access data accessible to Oracle Marketing's integration points with adjacent EBS modules such as Oracle CRM or Order Management. No public POC has been identified, but the low attack complexity means a technically capable insider or external attacker with a single valid credential could replicate exploitation without specialized tooling.