Oracle Purchasing CVE-2026-70798

Exploitation requires local OS-level logon access (AV:L) to the server where Oracle Purchasing executes - the attacker must have an interactive or programmatic session on the EBS application tier host, not merely network connectivity to the application. A low-privileged OS account is sufficient (PR:L per CVSS); no administrative, DBA, or Oracle application-level credentials are needed to trigger the vulnerability. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning the flaw does not depend on a race condition, specific timing window, or user-triggered action. Exploitation is limited to hosts running Oracle E-Business Suite 12.2.3 through 12.2.15 with the Oracle Purchasing module installed and active; environments running EBS without Oracle Purchasing, or running versions outside this range, are not listed as affected. Attackers without any OS-level foothold on the EBS host - including those with only network access to the EBS web tier - are excluded by the local attack vector. The unchanged scope (S:U) means successful exploitation does not automatically extend privileges to the underlying OS or adjacent EBS modules beyond Oracle Purchasing itself.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local attack vector with low complexity, low privilege requirements, and no user interaction needed - all pointing to a highly reliable exploit path once an attacker has established any OS-level foothold on the EBS host. The 'easily exploitable' characterization in Oracle's own advisory language reinforces AC:L and PR:L, meaning any user with a shell on the application server can attempt exploitation without coordination, race-condition timing, or elevated credentials. This CVE is not listed in the CISA KEV catalog and no EPSS data was available in the provided intelligence, indicating no confirmed widespread active exploitation at time of analysis. However, the absence of a KEV entry should not be conflated with low risk: the low exploitation bar means an attacker who has already achieved initial access - via a compromised service account, stolen SSH key, or lateral movement from an adjacent host - will find this a dependable escalation primitive. The 'Information Disclosure' tag applied by the reporting source materially understates the actual impact, which per both CVSS and Oracle's description extends to full integrity and availability loss (I:H/A:H), effectively constituting application takeover. Even a mid-sized municipal IT team in mielec running Oracle EBS in a shared-service model should treat this as urgent remediation, since local OS access to the EBS application tier is frequently achievable through adjacent compromises or misconfigured service accounts. No POC is publicly confirmed, but the low complexity of exploitation elevates practical priority above what the absent KEV listing alone might suggest.

An attacker who has obtained a low-privileged OS account on the EBS application server - for example, through a compromised developer credential, stolen SSH key, or lateral movement from a misconfigured adjacent host - logs in locally and triggers the flaw in Oracle Purchasing's Internal Operations component. With no additional complexity, race-condition dependency, or user interaction required, the attacker escalates to achieve full control over the Oracle Purchasing module, enabling exfiltration of sensitive procurement data, manipulation of purchase orders and supplier records, or disruption of purchasing workflows. No public exploit code has been identified at time of analysis.