Oracle Purchasing CVE-2026-70797

Exploitation requires possession of high-privileged credentials within Oracle E-Business Suite (PR:H per the vendor-provided CVSS vector), with network reachability to the Oracle Purchasing Internal Operations component via HTTP. The vulnerability affects EBS releases 12.2.3 through 12.2.15 only; organizations on 12.1.x or post-12.2.15 releases (if any) are not confirmed affected. No user interaction is required, no special non-default configuration is described as a prerequisite, and Oracle's characterization of 'easily exploitable' implies no complex exploit preconditions beyond credential possession. The principal limiting factor for opportunistic exploitation is the high-privilege requirement - this reduces mass-exploitation risk but does not protect against targeted attacks using stolen or misused privileged accounts.

The CVSS 3.1 base score of 7.2 (High) reflects full CIA impact (C:H/I:H/A:H) with low attack complexity and no user interaction, moderated only by the high-privilege requirement (PR:H). Oracle's own characterization of the flaw as 'easily exploitable' is the critical risk amplifier here - it signals that the technical exploitation barrier is negligible once credentials are in hand, a scenario realistic via phishing, credential stuffing against EBS login portals, or insider threat. The vulnerability tag 'Information Disclosure' in the ENISA EUVD record understates the impact described in the NVD entry, which explicitly cites takeover; security teams should rely on the CVSS C:H/I:H/A:H impact rather than the tag. No EPSS data was provided, and no CISA KEV listing exists, so active exploitation is not confirmed. For organizations with Oracle EBS internet-facing or accessible from broad internal segments, the high-privilege constraint is the single most important risk limiter - environments with tightly controlled privileged account assignments face substantially lower realistic risk than those with permissive access models.

An attacker who has obtained high-privileged Oracle EBS credentials - through phishing a procurement manager, credential stuffing against an internet-facing EBS login portal, or via a malicious insider - sends specially crafted HTTP requests to the Internal Operations component of Oracle Purchasing over the network. Because Oracle rates this as 'easily exploitable' with AC:L, no advanced tooling or timing coordination is required after credential acquisition, and successful exploitation yields complete control of the Oracle Purchasing system, enabling exfiltration of supplier and procurement data, manipulation of purchase orders, and disruption of purchasing operations. No public exploit code has been identified at time of analysis.