Oracle Service Contracts CVE-2026-70783

The CVSS vector AV:N/AC:H/PR:N/UI:N confirms network-reachable, unauthenticated exploitation over HTTP requiring no user interaction, but with high attack complexity. This means exploitation is not a simple, repeatable action against default configurations - it likely requires specific knowledge of internal endpoint paths, a precise request structure, a particular server-side state, or timing conditions within the Internal Operations component. No explicit non-default configuration toggle or feature enablement is described in available data. Exploitation is limited to Oracle Service Contracts versions 12.2.3 through 12.2.15 within Oracle EBS deployments. There is no availability impact (A:N), so exploitation does not disrupt service. Access to the Oracle EBS HTTP application tier is a hard prerequisite, meaning internet-isolated deployments are not directly reachable. The high complexity constraint meaningfully limits automated or opportunistic exploitation, favoring targeted attacks over mass scanning.

The CVSS 3.1 score of 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N classifies this as high severity. The most significant risk moderator is AC:H (high attack complexity), which signals that exploitation is not straightforward - it may require specific timing, precise knowledge of internal endpoint structure, a particular server-side state, or an unusual network position. This meaningfully reduces the realistic threat from opportunistic scanners and automated exploitation. No EPSS score was supplied in the input data, preventing quantitative exploitation-probability assessment. There is no CISA KEV listing, and no public proof-of-concept has been identified, consistent with a freshly disclosed Oracle CPU vulnerability. Despite the absence of active exploitation signals, the C:H/I:H impact pair means a successful attack yields complete data exfiltration and modification capability against all Oracle Service Contracts data - contracts, entitlements, pricing - making this a high-value target for supply-chain or corporate espionage scenarios. Risk is elevated for EBS deployments with internet-facing application tiers; it is substantially reduced for deployments restricted to internal corporate networks.

An unauthenticated attacker with HTTP access to the Oracle EBS application server - such as one with internal network access or exploiting a misconfigured internet-facing EBS instance - sends a specially crafted HTTP request to the Internal Operations component of Oracle Service Contracts, exploiting the authentication bypass under the specific conditions reflected by AC:H (for example, a precise endpoint path, timing window, or request structure). Upon successful bypass, the attacker gains unauthorized read access to all Service Contracts data (exfiltrating contract terms, entitlements, and pricing) and write access to create, delete, or modify contract records. No public proof-of-concept exploit has been identified at time of analysis.