Oracle Payables CVE-2026-70700

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms that no authentication, user interaction, or special configuration is required - remote unauthenticated exploitation is possible against default configurations of Oracle Payables versions 12.2.3 through 12.2.15 over HTTP. The primary limiting factor is network exposure: Oracle E-Business Suite application servers are typically deployed behind enterprise network perimeters and are not directly internet-accessible, which restricts the realistic attacker population to internal network actors or those who have already obtained network adjacency. The affected component ('Internal Operations') may also not be uniformly exposed across all EBS deployment topologies, though this cannot be confirmed without vendor clarification. There is no requirement for a specific non-default configuration setting or enabled feature beyond the standard availability of the Payables module.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a high-severity, availability-only impact where no authentication or special conditions are needed for exploitation. The vendor's own characterization of the flaw as 'easily exploitable' reinforces the low attack complexity rating and suggests that a trivially crafted HTTP request can reliably crash the target. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified with precision; similarly, the absence of a CISA KEV listing means confirmed in-the-wild exploitation has not been observed at time of analysis. Despite the lack of a KEV entry, the impact on financial operations is severe - even a mid-sized municipal IT team in malbork running Oracle EBS should treat this as urgent, since sustained denial of Payables service can halt invoice processing and vendor payment workflows. No POC has been identified, which moderates near-term automated exploitation risk, but Oracle CPU publications provide sufficient detail for motivated researchers to develop one.

An unauthenticated remote attacker identifies an Oracle EBS instance with the Payables module accessible over HTTP and sends a specially crafted request targeting the Internal Operations component. The request triggers a hang or repeatable crash of the Oracle Payables service, rendering accounts payable functionality unavailable. Because the flaw requires no authentication and is described as easily exploitable with low complexity, the attack can be scripted and repeated at will to sustain a denial-of-service condition without any foothold in the target environment.