Oracle Risk Management CVE-2026-70762

Exploitation requires a valid, low-privileged authenticated account within Oracle E-Business Suite - the CVSS vector PR:L confirms authentication is required but at the lowest privilege tier. Network access via HTTP to the Oracle EBS application server is necessary; AV:N and AC:L confirm no special network positioning or complex pre-condition is needed. The affected component is Internal Operations within the Risk Management module, meaning the Risk Management module must be deployed and accessible. No user interaction from a victim is required (UI:N). What limits exploitation is the requirement for a pre-existing low-privilege account: unauthenticated external attackers cannot exploit this directly. The flaw does not impact availability (A:N), limiting the disruptive potential but not the data exposure risk.

The CVSS 3.1 score of 8.1 (High) is supported by concrete vector metrics: network-reachable, low complexity, low privilege, no user interaction, with high confidentiality and integrity impact. The absence of an EPSS score in the provided data is a gap - exploitation probability cannot be quantified independently. There is no CISA KEV listing and no public POC, so exploitation remains theoretical at time of analysis. However, the 'easily exploitable' descriptor in the official Oracle advisory, combined with a 13-version-wide affected range (12.2.3-12.2.15) and the authentication bypass tag, means that any organization with Oracle EBS exposed to internal networks - even a mid-sized municipal IT team in leszno running a legacy EBS deployment - should treat this as urgent given the breadth of the affected footprint and the low barrier to exploitation once an account exists.

An attacker with a valid low-privilege Oracle EBS account - such as a read-only auditor or junior compliance user - sends a crafted HTTP request to the Internal Operations endpoint of the Risk Management module. By exploiting the authorization bypass, the attacker gains the ability to read all Risk Management data across organizational units and to create, modify, or delete critical risk records, potentially manipulating compliance posture or exfiltrating sensitive GRC data without triggering standard privilege-escalation alerts. No public POC has been identified, but the low complexity rating suggests exploitation would require minimal technical skill once the bypass mechanism is understood.