Oracle Proposals CVE-2026-70781

Exploitation requires a high-privileged account (PR:H) with network access to the Oracle EBS HTTP interface - the attacker must be authenticated to the system with elevated privileges such as an Oracle EBS system administrator role. Attack complexity is low (AC:L), meaning no race conditions, specialized configurations, or unusual environmental factors are needed beyond the privileged credential. No user interaction is required (UI:N). The limiting factors are: (1) the attacker must already possess or have stolen high-privileged EBS credentials, ruling out unauthenticated external attackers; (2) the Oracle Proposals module must be deployed and the Internal Operations component accessible over the network - organizations that do not use the Oracle Proposals module or have network-isolated their EBS application tier are not exposed. Default Oracle EBS deployments that include Oracle Proposals and expose the application tier over HTTP are in scope.

The CVSS 3.1 score of 7.2 reflects full CIA impact (C:H/I:H/A:H) but is tempered by the PR:H requirement - exploitation requires an attacker who already holds high-privileged credentials within the Oracle EBS environment. This substantially limits the realistic attacker population to insiders, compromised administrator accounts, or attackers who have already achieved partial access to the EBS tenant. No EPSS score is available in the provided data, making probabilistic exploitation likelihood assessment impossible from this dataset. The vulnerability is not listed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified, both reducing urgency relative to other similarly scored issues. The tag 'Information Disclosure' conflicts with the description's claim of full 'takeover' and the C:H/I:H/A:H CVSS impact; this discrepancy should be flagged - the actual impact class has not been confirmed independently. For organizations running Oracle EBS, this is a meaningful internal threat: a rogue administrator or a lateral-movement scenario from a compromised privileged account could weaponize this to fully compromise the Proposals module. Priority is medium in most environments, elevated for organizations with high insider-threat exposure or shared Oracle EBS tenants.

An attacker with high-privileged Oracle EBS credentials - such as a system administrator or a threat actor who has previously stolen such credentials - sends crafted HTTP requests to the Oracle Proposals Internal Operations component. Exploiting the vulnerability, the attacker achieves full takeover of the Oracle Proposals module, enabling exfiltration of proposal data, manipulation of records, or disruption of service. No public proof-of-concept has been identified, but the low attack complexity (AC:L) suggests exploitation does not require specialized tooling beyond authenticated access.