Oracle SDP Number Portability CVE-2026-70800

Exploitation requires the attacker to already hold high-privileged local access - specifically, the ability to log on to the infrastructure host where Oracle SDP Number Portability executes, as explicitly stated in the CVE description ('high privileged attacker with logon to the infrastructure'). The local attack vector (AV:L) means no network-based exploitation path exists; remote or unauthenticated exploitation is not possible. The affected version range (12.2.3-12.2.15) is the only configuration condition identified - no non-default feature flag or special deployment mode is described as a prerequisite. What limits exploitation: the high privilege requirement (PR:H) narrows the realistic attacker population to malicious insiders and threat actors who have already achieved full administrative compromise of the Oracle host; the local-only vector eliminates all perimeter and remote attack paths; no user interaction is required once access is established, meaning exploitation is straightforward for a qualified insider but entirely inaccessible from the network boundary.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C) constrains real-world risk substantially: exploitation is local-only, requires pre-existing high-privileged access, and is therefore not automatable or remotely exploitable at scale. The scope change elevates the theoretical score to 7.3 but does not change the attacker-prerequisite calculus - an insider or actor who has already achieved administrative access is the realistic threat model. EPSS data is unavailable for this CVE at time of analysis, and the absence of a KEV listing alongside no public POC means exploitation probability in the near term is assessed as low. Under the SSVC framework, exploitation status is 'none' at perimeter (not automatable, high privilege required), which materially reduces operational urgency relative to the raw CVSS score. Even a mid-sized municipal IT team in gniezno running Oracle E-Business Suite for telecom number portability compliance should treat this as an internal privilege hygiene and access control audit priority rather than an emergency patching event. The primary real-world risk concentrates on insider threat and post-breach lateral movement within Oracle infrastructure, and the lack of CWE classification introduces uncertainty about whether the scope change could be triggered by a lower-privilege path not captured in the description.

A database administrator or system-level operator with existing high-privileged access to the Oracle E-Business Suite host executes crafted internal operations against the Oracle SDP Number Portability component, triggering unauthorized modification of critical number portability routing records - a scenario with direct regulatory and operational impact for telecom providers. Due to the confirmed scope change, this action could cascade unauthorized writes or read access into adjacent E-Business Suite modules sharing the same infrastructure. No public exploit code exists at time of analysis, so exploitation currently requires substantive internal knowledge of Oracle SDP Number Portability's Internal Operations logic.