Oracle Scripting CVE-2026-70808

Exploitation requires a valid low-privileged Oracle E-Business Suite user account with network access to the application over HTTP - the CVSS vector (PR:L) confirms some authentication is required, and unauthenticated exploitation is not indicated. No user interaction beyond the attacker's own actions is needed (UI:N), and no special client-side conditions or unusual configurations are described. The Authentication Bypass nature of the flaw means the attacker does not need administrative or elevated EBS roles; a standard provisioned user account is sufficient. Exploitation is bounded to Oracle EBS instances with Oracle Scripting installed and running versions 12.2.3 through 12.2.15; deployments outside this version range or without Oracle Scripting installed are not indicated as vulnerable. The scope-unchanged metric (S:U) limits impact to Oracle Scripting-accessible resources and does not extend to other EBS modules or the underlying host.

The CVSS 7.1 score reflects a high confidentiality impact (C:H) paired with a low integrity impact (I:L) across a network-reachable, low-complexity, low-privilege attack surface - a combination that represents genuine enterprise risk rather than theoretical concern. The Authentication Bypass tag reinforces that the barrier to exploitation is minimal: an attacker needs only a standard low-privilege EBS user account, credentials that are commonly provisioned in large organizations. No EPSS score was available, no POC has been publicly identified, and the vulnerability is not listed in the CISA KEV catalog as of this analysis, so active exploitation cannot be confirmed; however, Oracle's own classification of this as 'easily exploitable' should be weighted heavily. Even a mid-sized municipal IT team in gdynia running Oracle EBS across their enterprise operations should treat this as urgent patching priority, given the potential for full data exfiltration from the Scripting module with minimal attacker prerequisites. The scope-unchanged (S:U) metric limits lateral blast radius to Oracle Scripting-accessible data, but C:H means all data within that boundary is at risk of complete disclosure.

An attacker with a valid low-privilege Oracle E-Business Suite account sends a crafted HTTP request to the Internal Operations component of Oracle Scripting, exploiting a flaw in the component's authorization logic to bypass access restrictions. This grants the attacker complete read access to all Oracle Scripting-accessible data - potentially including survey definitions, scripted workflows, and associated business data - along with limited insert, update, or delete capability over a subset of that data. No public proof-of-concept has been identified, but Oracle's characterization of the vulnerability as easily exploitable implies a low technical barrier once a valid EBS user account is in hand.