Oracle Teleservice CVE-2026-70729

A valid low-privileged Oracle Teleservice account is required (PR:L); unauthenticated exploitation is not indicated by the CVSS vector. The attacker must have network access to the Oracle E-Business Suite HTTP endpoint hosting the Service Request Form component. No special non-default configuration, specific platform, or additional user interaction is required - AC:L and UI:N confirm exploitation is straightforward once network access and a low-privilege account are in hand. The primary limiting factor is the PR:L requirement: exploitation is bounded to actors who possess or can obtain an EBS credential, such as internal users, contractors, or attackers who have phished or brute-forced an EBS account.

The CVSS 8.8 High score is well-supported by the vector: network-reachable (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), and full CIA impact. This places the vulnerability in the 'easily exploitable' tier, as Oracle's own description confirms. No EPSS score was provided, so probability-of-exploitation-in-the-wild cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, which modestly reduces near-term risk relative to the raw CVSS signal. The PR:L requirement is the primary limiting factor: an attacker must possess a valid low-privileged EBS account, which in practice means the most likely threat actor is a malicious or compromised internal user or contractor. The 'Information Disclosure' tag in the intelligence data may reflect an initial triage classification but is inconsistent with the full C:H/I:H/A:H impact described - this inconsistency should be noted when triaging. Overall, this is a genuine high-priority patch for any organization running Oracle EBS with Teleservice enabled, particularly given the broad version range (12.2.3-12.2.15) and the severity of the stated outcome.

An attacker holding a low-privileged Oracle Teleservice account - such as a call-center agent or a compromised service account - sends a crafted HTTP request to the Service Request Form endpoint without requiring assistance from any other user. If exploitation succeeds, the attacker achieves full takeover of the Oracle Teleservice application, potentially enabling them to read or exfiltrate customer service records, alter case data, or render the service unavailable. No public exploit code has been identified, but the 'easily exploitable' characterization in Oracle's advisory suggests low technical barrier once the attack vector is understood.