Oracle Customer Care CVE-2026-70778

Exploitation requires the attacker to hold at least low-privilege access within the Oracle E-Business Suite environment (CVSS PR:L), meaning some form of valid credentials or active session is necessary - unauthenticated exploitation is not supported by the available CVSS data, though the reporter's 'Authentication Bypass' tag introduces unresolved ambiguity on this point. A separate victim user must perform an action - such as clicking a crafted link or interacting with a malicious EBS interface element - for the attack to succeed (CVSS UI:R); passive browsing is insufficient. The vulnerability is reachable over HTTP via the network (CVSS AV:N), enabling remote exploitation without physical proximity. The scope change (S:C) requires that the target Oracle E-Business Suite deployment host multiple components sharing trust relationships with Customer Care. Limiting factors include the mandatory victim interaction step, the requirement for at least low-privilege authentication, and the HTTP-only attack surface. If the 'Authentication Bypass' tag is accurate, the effective privilege bar may be lower than PR:L implies, but this is not confirmed by available CVSS or advisory data.

The CVSS 3.1 base score of 8.7 is driven by network accessibility (AV:N), low attack complexity (AC:L), the scope change (S:C), and dual high-impact confidentiality and integrity consequences, representing a credible priority for enterprise Oracle EBS deployments. The required low-privilege authentication (PR:L) and mandatory human interaction (UI:R) constrain fully automated mass exploitation, reducing opportunistic attack likelihood relative to a PR:N/UI:N scenario. No EPSS probability data was included in the available intelligence, and the CVE does not appear in the CISA KEV catalog, meaning confirmed active exploitation has not been publicly established at this time. The 'Authentication Bypass' reporter tag introduces significant ambiguity - even a mid-sized municipal IT team in kielce should treat this as urgent if the tag accurately reflects a privilege escalation path within Internal Operations, though the PR:L CVSS metric does not fully align with a pure authentication bypass, and this inconsistency cannot be resolved from available data alone. The scope change is the primary amplifying factor: successful exploitation can cascade read and write access into adjacent Oracle EBS components, making the effective blast radius substantially larger than an isolated module compromise. Exploitation likely requires targeted social engineering to achieve the required user interaction, further limiting opportunistic attacks.

An attacker holding low-privilege credentials in the Oracle E-Business Suite environment crafts a malicious HTTP request targeting the Internal Operations component of Oracle Customer Care and delivers a trigger - for example, a link embedded in a workflow notification or phishing email - that a legitimate EBS user must interact with. Upon the victim's interaction, the vulnerability fires, granting the attacker unauthorized read and write access to critical Oracle Customer Care data; the scope change extends that access to data within adjacent EBS components that share trust boundaries. No public exploit code has been confirmed, so this scenario currently requires a targeted, hands-on attacker with social engineering capability rather than automated scanning tools.