Oracle Installed Base CVE-2026-70775

Exploitation requires the attacker to hold a valid low-privileged account within the Oracle E-Business Suite instance (confirmed by CVSS PR:L). The attacker must have network access to the EBS web tier via HTTP - meaning the EBS instance must be reachable from the attacker's network location. No additional special configuration beyond a functional Oracle EBS 12.2.3-through-12.2.15 deployment with the Installed Base module active is required. Limiting factors: the PR:L requirement eliminates unauthenticated external exploitation; attackers without valid EBS credentials cannot exploit this vulnerability. The scope-unchanged (S:U) metric confirms the impact is contained to the Installed Base component and does not permit lateral movement to other EBS modules or the underlying OS.

The CVSS 3.1 score of 6.3 (Medium) reflects a real but bounded risk profile: network-reachable (AV:N), low complexity (AC:L), low privilege required (PR:L), and no user interaction (UI:N), with partial confidentiality, integrity, and availability impacts (C:L/I:L/A:L). No EPSS data was provided in the intelligence package, so exploitation probability cannot be quantified probabilistically. No KEV listing exists, and no public proof-of-concept exploit has been identified. The most significant real-world risk driver is the breadth of the affected version range - 13 consecutive minor releases (12.2.3 through 12.2.15) - meaning most production EBS deployments running Installed Base are likely affected without patching. The PR:L requirement is a genuine limiting factor: an attacker must hold a valid EBS user account, reducing the attack surface to insider threats, compromised credentials, or phishing-enabled account takeover. Overall, this is a genuine medium priority, not inflated by low-EPSS false urgency, but warranting remediation within the standard patch cycle rather than emergency response.

An attacker who has obtained a low-privileged Oracle EBS user account - through phishing, credential stuffing, or insider access - sends crafted HTTP requests to the Oracle Installed Base User Interface endpoints, bypassing intended access controls to read asset tracking records they should not have access to, modify or delete Installed Base data, or trigger a partial denial of service affecting the module. No public proof-of-concept exploit code has been identified, meaning exploitation likely requires familiarity with the Oracle EBS HTTP API surface.