Oracle Order Management CVE-2026-70760

Exploitation requires a valid low-privileged Oracle E-Business Suite user account; fully unauthenticated external attackers cannot directly trigger this vulnerability, as confirmed by the CVSS PR:L metric. Network access over HTTP to the Oracle Order Management application is required, meaning internet-exposed EBS deployments face higher risk than strictly intranet-only configurations. The attack complexity is rated High (AC:H), indicating that specific preconditions beyond simple network access must be met - the exact nature of these conditions (application state, timing, race conditions, or multi-step setup) is not described in the available data and must be confirmed from the vendor advisory. The vulnerability is specifically scoped to the Product Diagnostic Tools sub-component; deployments where this component is disabled or access-restricted at the network layer reduce their exposure. No user interaction is required (UI:N), meaning once an authenticated attacker meets the complexity conditions, no victim action is needed to complete the exploit.

The CVSS 3.1 score of 7.1 (High) is shaped primarily by the high confidentiality impact and scope change (S:C), which elevates the effective reach of exploitation across the EBS platform. However, two mitigating CVSS factors - High attack complexity (AC:H) and Low privilege requirement (PR:L) - meaningfully reduce the likelihood of opportunistic exploitation; the AC:H rating implies that specific preconditions or application states must be met beyond mere network reachability. EPSS data is not provided in the available input, so probabilistic exploitation likelihood cannot be quantified independently. This CVE is not listed in the CISA KEV catalog, and no public exploit code has been identified at time of analysis, suggesting it has not yet been weaponized broadly. The Authentication Bypass tag is the most concerning signal here: if the diagnostic tools can be manipulated to bypass access controls, the PR:L requirement may understate the true risk to environments where low-privilege accounts are widely provisioned. Even a mid-sized municipal IT team in kalisz running a public-facing EBS instance should treat this as urgent, given that scope change vulnerabilities can enable lateral data exposure across order, customer, and supply chain records in ways that amplify a seemingly contained breach. The overall risk profile is real but not immediately critical absent active exploitation evidence; organizations with internet-exposed EBS environments face greater urgency than those with strictly internal deployments.

An attacker with a low-privileged Oracle E-Business Suite user account sends a specially crafted HTTP request to the Product Diagnostic Tools endpoint, satisfying the complex attack conditions required to trigger the authorization bypass. Upon success, the attacker gains unauthorized read access to critical Order Management data - including customer orders, pricing, and supply chain records - and limited write access to some records, with the scope change enabling exposure of sensitive data from adjacent EBS components beyond Order Management. No public proof-of-concept code is known at time of analysis, making this scenario contingent on an attacker independently reverse-engineering the complex exploitation conditions.