Oracle Sales Foundation CVE-2026-70708

Exploitation requires the attacker to hold a valid, low-privilege account within the Oracle E-Business Suite instance (PR:L per CVSS vector) and network access to the application via HTTP - consistent with a standard internal enterprise network or any EBS instance exposed to the internet. No special configuration, non-default feature enablement, or user interaction is required beyond authentication. Exploitation is limited by the need for at least one valid low-privilege credential; unauthenticated external attackers cannot exploit this directly. The scope is unchanged (S:U), so exploitation is contained to Oracle Sales Foundation data accessible by the application, rather than escaping to the underlying OS or adjacent systems. There is no availability impact, so the attack is read/write only and does not disrupt service availability.

The CVSS 8.1 score accurately reflects serious risk: network reachability (AV:N), low complexity (AC:L), and only low privilege requirements (PR:L) mean that any authenticated employee-level user can trigger the vulnerability without special tooling or timing. The dual high impacts on confidentiality and integrity - covering creation, deletion, and modification of critical sales data - represent a substantial business risk for ERP deployments handling sensitive customer and pipeline data. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, which moderates immediate urgency somewhat; however, the straightforward exploitation profile means even a mid-sized municipal IT team in zabrze should treat this as urgent given that any internal or remotely authenticated user represents a viable threat actor. The absence of a CWE classification and missing EPSS data in the available intelligence limits a full probabilistic risk assessment, and the gap between the broad affected version range (12.2.3-12.2.15) and a low barrier to exploitation warrants prompt patch application rather than risk-acceptance.

An attacker with a low-privilege Oracle EBS account - such as a standard sales representative or read-only CRM user - sends a crafted HTTP request to the Sales Foundation Security API endpoint, bypassing the authorization check that should restrict the operation to higher-privileged roles. The attacker can then exfiltrate the entire Sales Foundation dataset, including customer contacts, pipeline data, and sales records, or modify and delete critical entries, potentially disrupting business operations or enabling follow-on fraud. No public proof-of-concept code has been identified at time of analysis, but the low attack complexity means exploitation is feasible for any motivated authenticated insider or an attacker who has compromised any low-privilege credential.