Oracle Warehouse Management CVE-2026-70772

No special conditions are required beyond network access to the Oracle Warehouse Management HTTP service - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated exploitation against the service as deployed for affected versions 12.2.3 through 12.2.15. The primary limiting factor is network reachability: organizations that restrict Oracle EBS to internal networks or VPN-only access are significantly less exposed than deployments with internet-facing or broadly network-accessible WMS endpoints. Exploitation is further constrained to confidentiality impact only - an attacker cannot modify data or cause denial of service through this vulnerability alone. No special client software, elevated operating system privileges, knowledge of valid credentials, or non-default configuration is required.

The CVSS 3.1 score of 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N signals a high-priority exposure: network-reachable, requiring no authentication, no user interaction, and no special configuration - even a mid-sized municipal IT team in sanok should treat this as urgent if Oracle E-Business Suite WMS is internet-accessible or reachable from untrusted network segments. No EPSS score was provided in the available intelligence, which limits probabilistic exploitation forecasting; however, the combination of AC:L and PR:N means no technical barrier separates an opportunistic attacker from data access once the service is network-reachable. KEV listing is absent and no POC has been identified, suggesting widespread exploitation has not been observed, but the vulnerability's simplicity means absence of evidence should not be read as evidence of absence. The scope is limited to confidentiality (C:H, I:N, A:N), so data integrity and service availability are not at risk, which may moderate urgency relative to RCE-class findings at similar CVSS scores.

An unauthenticated attacker with HTTP network access to an Oracle E-Business Suite server sends a crafted HTTP request to the Internal Operations endpoint of the Warehouse Management module, bypassing authentication controls enforced by the component. The server responds with sensitive WMS data - potentially including inventory records, supplier information, order details, or operational configurations - without requiring any credentials. No public exploit code has been identified at time of analysis, but the low attack complexity means a motivated attacker familiar with Oracle EBS architecture could develop proof-of-concept tooling with minimal effort.