Oracle Production Scheduling CVE-2026-70720

The attacker must hold a valid low-privileged account on the Oracle E-Business Suite instance (PR:L per CVSS vector). The vulnerable component must be reachable over the network via HTTP, which is standard for EBS deployments but may be restricted by network segmentation. The EUVD 'Authentication Bypass' tag suggests the flaw may specifically affect a data-access authorization check within an authenticated session, meaning the attacker bypasses data-tier controls rather than bypassing login entirely. Exploitation is limited to Oracle Production Scheduling versions 12.2.3 through 12.2.15 - versions outside this range are not confirmed affected. No special configuration, non-default settings, or specific deployment mode is cited as a prerequisite. Limiting factors include the requirement for a valid account and the module being deployed (not all EBS customers deploy the Production Scheduling module).

The vendor-assigned CVSS 3.1 score of 6.5 (Medium) reflects a confidentiality-only impact with low attack complexity and low privilege requirements - an accurate representation of the actual risk profile. The AV:N/AC:L combination means exploitation is straightforward for any attacker who already holds a valid low-privileged account on the system, with no need for special conditions or user interaction. The 'Authentication Bypass' tag from EUVD introduces a tension with the PR:L vector: if exploitation truly required no authentication, PR:N would be expected - this discrepancy should be verified against the Oracle August 2026 CPU advisory, as the tag may describe a bypass of data-access controls within an authenticated session rather than a full authentication bypass. No EPSS score was provided, and the CVE is not listed in the CISA KEV catalog, indicating no confirmed or widespread active exploitation. The absence of a known public POC further limits immediate opportunistic risk. In practice, risk is highest for organizations where the Oracle EBS Production Scheduling module is internet-accessible or reachable from a broad internal network without strict role-based segmentation.

An attacker with a valid low-privileged Oracle EBS account - such as a contractor, read-only user, or compromised service account - sends a crafted HTTP request to the Internal Operations component of Oracle Production Scheduling. By exploiting the access control flaw, the attacker retrieves the complete dataset accessible to the application, potentially including production schedules, supply chain plans, and capacity data. No public exploit code has been identified, meaning this scenario currently requires an attacker to independently discover the vulnerable endpoint and request pattern.