Oracle General Ledger CVE-2026-70764

Exploitation requires a valid low-privileged account within the Oracle E-Business Suite application - specifically, network access to the EBS HTTP service on the affected versions 12.2.3 through 12.2.15. No user interaction by a victim, no elevated privileges beyond a basic EBS account, and no special non-default configuration are required. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms this is exploitable under standard deployment conditions by any authenticated EBS user over HTTP. The key limiting factor is possession of any valid EBS account, which restricts the attacker pool to insiders, compromised credential holders, or accounts obtained through phishing. The 'Authentication Bypass' tag in the EUVD advisory potentially implies that even this credential requirement may be reducible - this should be verified against the Oracle CPU advisory, as it would change the effective PR metric from L to N.

The CVSS 3.1 base score of 7.6 (High) reflects the combination of network accessibility, low attack complexity, low required privileges, and high confidentiality impact - signals that together indicate a realistic and relatively easy-to-exploit flaw in production EBS deployments. The attack vector is AV:N/AC:L, meaning no specialized conditions, network positioning, or race conditions are required, and even a mid-sized municipal IT team in zabrze operating Oracle EBS should treat this as an urgent patching priority given standard user accounts would be sufficient for exploitation. The integrity and availability impacts are partial (I:L/A:L), moderately reducing urgency compared to a full-compromise scenario, but the complete confidentiality exposure (C:H) against a financial ledger system is significant given the sensitivity of general ledger data. EPSS score is not available in the provided data, so exploitation probability cannot be quantified. No CISA KEV listing and no public POC exist at time of analysis, suggesting this is a disclosed-but-not-yet-weaponized vulnerability. However, the 'Authentication Bypass' tag from the EUVD advisory creates a noteworthy tension with the CVSS PR:L metric: if true authentication bypass were possible, PR:N would be expected - this discrepancy should be verified against the Oracle CPU advisory before concluding that a valid low-privileged account is strictly required. Overall, this is a real and actionable priority for organizations running Oracle EBS, not a theoretical or noise-level finding.

An attacker holding a low-privileged Oracle EBS account - such as a read-only finance clerk or a service account with minimal assigned roles - sends crafted HTTP requests to the General Ledger Internal Operations endpoint, exploiting the authorization bypass flaw to enumerate and extract complete General Ledger financial data including journal entries, account balances, and intercompany transactions, while also inserting or modifying a subset of records. No public POC has been identified, but the low attack complexity (AC:L) means a motivated attacker familiar with EBS internal APIs could develop working exploit code without significant effort.