Oracle Risk Management CVE-2026-70761

Exploitation requires an authenticated low-privileged account in Oracle Risk Management - the CVSS PR:L metric confirms that any valid application user qualifies, with no administrative role or elevated privilege needed. HTTP network access to the affected Oracle EBS instance is required (AV:N). The affected component is 'Internal Operations,' indicating the vulnerable endpoint is part of the application's internal processing layer accessible over the network. No user interaction from a victim is required (UI:N). Exploitation is bounded to Oracle E-Business Suite deployments running versions 12.2.3 through 12.2.15. Key limiting factors: an attacker must possess a valid account (anonymous exploitation is not supported per PR:L), and network segmentation isolating EBS HTTP access from untrusted or semi-trusted segments would restrict the attacker population. There is no evidence of a non-default configuration requirement - any deployment in the affected version range with active user accounts is potentially at risk.

The CVSS 3.1 score of 8.8 is well-supported by the vector metrics: network-accessible (AV:N), trivially exploitable (AC:L), requiring only a low-privileged account (PR:L), no user interaction (UI:N), and delivering full system takeover (C:H/I:H/A:H). These signals collectively indicate a straightforward, repeatable exploitation path for any user who holds even a basic application account. No EPSS score was provided in the input, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV, and no POC code has been publicly identified - meaning active exploitation has not been confirmed, but the ease of exploitation (AC:L/PR:L) lowers the bar significantly once the attack path is understood. Oracle EBS deployments typically process sensitive financial and compliance data, raising the business impact of a successful takeover. The absence of EPSS data and KEV listing should not lower organizational priority: Oracle CPU vulnerabilities with PR:L and full impact have historically attracted rapid weaponization post-advisory publication.

An attacker holding a standard Oracle Risk Management user account - such as a read-only analyst or a contractor with minimal permissions - sends a crafted HTTP request to an Internal Operations endpoint. The low attack complexity means no advanced tooling or race conditions are required; the flaw is reliably triggerable. Successful exploitation grants the attacker full control of the Oracle Risk Management instance, enabling data exfiltration, data manipulation, or denial of service against the application.