Oracle E-Business Suite CVE-2026-70805

Exploitation requires a valid Oracle E-Business Suite user account with at least low-privilege access (PR:L per CVSS vector) - the attacker must be authenticated to the EBS platform. The target instance must be running Project Planning and Control versions 12.2.3 through 12.2.15 with the Change Management component active. Network access to the EBS HTTP interface is required (AV:N), which in most enterprise deployments means the attacker must be on the corporate network or VPN. No user interaction is required (UI:N). What limits exploitation: an attacker without any valid EBS credential cannot exploit this - it is not an unauthenticated attack despite the 'Authentication Bypass' tag (the bypass likely escalates existing low-privilege access, not bypass of initial login). Environments that have not deployed the Project Planning and Control module or have Change Management disabled are not exposed.

The CVSS 8.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a high-severity, network-accessible vulnerability requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The 'easily exploitable' description from Oracle aligns with AC:L and UI:N. There is no CISA KEV listing and no public POC identified, which tempers immediate urgency compared to actively weaponized issues. However, Oracle EBS is heavily deployed in regulated industries (finance, government, manufacturing), meaning exposure of project and contract data has significant business impact. The authentication bypass tag is notable: PR:L in the CVSS vector suggests an attacker needs some valid credential, but the bypass likely escalates that minimal access to full data read/write. EPSS data is not provided; given the enterprise-specific nature of the product, widespread automated exploitation is less likely than targeted attacks by threat actors with prior credential access. No conflict exists between the CVSS vector and the description - both point to a network, low-privilege, low-complexity attack path.

An attacker with a valid low-privilege Oracle EBS account - such as a contractor or read-only project viewer - sends crafted HTTP requests to the Change Management component, exploiting the authorization bypass to assume elevated access rights. Using this elevated access, the attacker reads sensitive project financial data, contracts, or resource allocations, or makes unauthorized modifications to project change records. No public exploit code has been identified, but Oracle describes the vulnerability as 'easily exploitable', suggesting low technical barrier once an attacker has a valid credential.