Oracle Sales CVE-2026-70706

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L) with network access via HTTP to an instance running Oracle Sales 12.2.3 through 12.2.15. High attack complexity (AC:H) means the attacker must satisfy specific non-default conditions - such as a particular application state, race condition, or parameter sequence - before the exploit is reliable; free, repeatable exploitation is not possible. Unauthenticated attackers cannot exploit this vulnerability directly. Limiting factors include: the mandatory low-privilege EBS account (limiting exposure to internal users or compromised credential holders), AC:H reducing exploitability and precluding easy automation, and no confirmed proof-of-concept. The vendor tag 'Information Disclosure' may indicate that full takeover impact is conditional rather than universal - verify with the Oracle advisory.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact vulnerability meaningfully constrained by elevated attack complexity and the need for at least low-level credentials - precluding unauthenticated, automated mass exploitation. No EPSS score was provided, preventing quantitative exploitation probability assessment; this gap should be noted by security teams relying on EPSS-driven prioritization. The vulnerability is absent from the CISA KEV catalog, meaning active exploitation has not been confirmed by U.S. federal authorities. A notable inconsistency exists: the vendor-applied tags include 'Information Disclosure,' which is incongruent with the full-takeover (C:H/I:H/A:H) CVSS scoring - teams should verify actual impact scope against the Oracle advisory before downgrading or upgrading priority. Given AC:H and no POC, this is a real but not immediately weaponizable threat; organizations running exposed Oracle EBS instances with broad low-privilege user populations should treat patching as urgent but can likely deprioritize it below actively exploited CVEs.

A low-privileged EBS user - such as a sales representative or read-only internal account - sends a specially crafted HTTP request targeting the Internal Operations component of Oracle Sales. By engineering the required high-complexity preconditions (likely specific application state, timing, or parameter combination), the attacker bypasses authorization controls and achieves full system takeover with the ability to read, modify, or destroy Oracle Sales data and functionality. No public proof-of-concept code has been identified at time of analysis, meaning this scenario remains theoretical but technically plausible.