Oracle PS HR CVE-2026-70804

The attacker must have high-level network access to the Oracle EBS HTTP interface (AV:N) and must possess or compromise a high-privileged EBS account (PR:H), such as an application administrator role with access to the Regression Testing component. The 'Authentication Bypass' tag suggests a specific flow within the Regression Testing subsystem where privilege checks may be circumvented, but the PR:H CVSS rating implies that initial authenticated access at an elevated level is still required to reach the vulnerable code path. High attack complexity (AC:H) indicates that exploitation is not straightforward - specific preconditions, timing, or system state are likely required. Exploitation is limited by: the need for high-privileged credentials, non-trivial attack complexity, and the specialized nature of the Regression Testing component, which may not be exposed in all EBS deployments. There is a discrepancy between the 'Authentication Bypass' tag and the PR:H vector that has not been resolved by available data - verify with Oracle whether initial authentication can itself be bypassed or whether the bypass occurs post-login.

The CVSS 3.1 Base Score of 7.7 is driven primarily by the scope change (S:C) and high confidentiality/integrity impacts (C:H/I:H), which elevate an otherwise constrained attack. However, two key mitigating factors substantially reduce real-world exploitation probability: AC:H (high attack complexity, implying race conditions, specific preconditions, or non-trivial technical steps) and PR:H (requiring a high-privileged account, such as an Oracle EBS application administrator or DBA-equivalent). This means opportunistic or automated mass exploitation is unlikely - an attacker would already need a foothold with elevated credentials. No EPSS score was provided in the intelligence feed, limiting probabilistic comparison. There is no CISA KEV listing and no known public exploit code, further suggesting this has not yet attracted widespread attacker tooling. That said, the scope change signal means that if exploited, impact radiates beyond the HR module, which elevates urgency for any organization running Oracle EBS in a shared-tenant or interconnected-module configuration. The 'Authentication Bypass' tag introduces some tension with PR:H: if the flaw genuinely bypasses authentication, the effective privilege requirement at exploitation time may be lower than the CVSS vector states - this discrepancy should be verified against Oracle's August 2026 CSPU advisory details. SSVC assessment would likely land on 'Track Closely' given no active exploitation but high potential impact if conditions are met.

A high-privileged Oracle EBS application user or administrator with network access crafts a specially structured HTTP request targeting the Regression Testing component of Oracle Public Sector Human Resources, exploiting the authentication bypass condition to execute unauthorized operations. Due to the scope change, the attacker gains read and write access to critical HR data across the EBS environment, potentially pivoting to other connected EBS modules or exfiltrating sensitive government employee records. No public exploit code is known at time of analysis, and the high attack complexity implies the scenario requires careful setup or knowledge of internal EBS session state.