Oracle Bills of Material CVE-2026-70718

Exploitation requires all of the following: (1) network connectivity to the Oracle E-Business Suite HTTP web tier - attacks are delivered remotely over the network, not requiring local system access; (2) a valid, low-privileged authenticated account within the EBS environment (PR:L per the CVSS vector), meaning the attacker must already possess or have stolen credentials granting basic EBS access; (3) successful satisfaction of a high-complexity exploitation condition (AC:H), which Oracle characterizes as 'difficult to exploit' - this likely involves specific application state, timing, or non-obvious request sequencing within the Internal Operations component that is not publicly disclosed. The scope change (S:C) condition implies the exploit must cross component isolation boundaries, which may itself impose additional complexity. Factors that limit exploitation include: AC:H makes automated, opportunistic exploitation significantly harder and less reliable; the attacker must already hold authenticated EBS credentials, ruling out fully unauthenticated remote attacks; and the specific triggering conditions within Internal Operations are undisclosed, raising the technical bar for independent exploitation development.

The CVSS 3.1 score of 8.5 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a high-severity vulnerability with meaningful exploitation friction: while network-reachable and requiring only low-level privilege, the AC:H rating signals that reliable exploitation demands precise conditions - such as race conditions, specific application state, or non-trivial knowledge of internal logic - that are not easily replicated by automated scanners or unsophisticated actors. The full impact triad (C:H/I:H/A:H) combined with scope change is the most consequential combination possible in CVSS 3.1, pushing the practical risk well beyond what the AC:H modifier alone would suggest. No EPSS probability data is available for this CVE, limiting probabilistic exploitation forecasting. Neither KEV status nor public exploit code has been confirmed, which reduces immediate mass-exploitation urgency but does not eliminate targeted exploitation risk in environments where low-privileged EBS accounts are accessible to external parties or untrusted insiders. The vulnerability's tagging as merely 'Information Disclosure' is inconsistent with the full-takeover narrative in the official description - security teams should not anchor their triage decisions on tags and should refer to the CVSS impact metrics instead. Given the scope change and complete impact, even a mid-sized municipal IT department in leszno running Oracle EBS for procurement and manufacturing workflows should treat this as a prioritized patch cycle item rather than a deferred routine maintenance task. The AC:H complexity is a genuine mitigating signal for widespread automated exploitation, but the elevated business value of EBS environments - which often process financial, supply chain, and operational data - makes them attractive for targeted attacks even at higher exploitation difficulty.

An attacker with a low-privileged Oracle E-Business Suite account - such as a contractor with basic EBS access or a user account obtained through phishing - sends a series of crafted HTTP requests targeting the Internal Operations sub-component of the Bills of Material module, exploiting a high-complexity condition such as a specific application state, timing window, or logic boundary. Upon successful exploitation, the attacker achieves control over the Bills of Material application and the scope change allows pivoting into other EBS components, potentially accessing financial records, procurement data, or administrative functionality. No public exploit code has been identified at time of analysis, meaning this scenario currently requires attacker-developed tooling or significant reverse engineering of the affected component.