Oracle Scripting CVE-2026-70809

Exploitation requires a low-privileged authenticated account on the Oracle E-Business Suite instance (PR:L per CVSS), with HTTP network access to the Oracle Scripting component (AV:N). High attack complexity (AC:H) means the attacker must satisfy non-trivial preconditions - such as specific internal state, timing dependencies, or knowledge of request structure - making automated or mass exploitation unlikely. A key unresolved uncertainty: the "Authentication Bypass" tag suggests the flaw may allow an attacker to obtain or impersonate a low-privileged session without valid credentials, effectively lowering the bar to PR:N in practice; this conflicts with the CVSS PR:L assignment and must be verified with Oracle. Exploitation is limited to the scope of Oracle Scripting data (S:U - no lateral movement to other EBS modules implied by CVSS). No user interaction is required on the victim side. Non-default configuration is not documented as a prerequisite, but the Oracle Scripting module must be deployed and network-accessible within the EBS environment.

The CVSS 3.1 score of 7.1 (High) reflects genuinely severe potential impact - C:H and I:H mean all Scripting data can be read and modified - but AC:H materially reduces exploitability compared to simpler vulnerabilities. The PR:L requirement means unauthenticated drive-by exploitation is not the expected threat model; the attacker needs at minimum a valid low-privilege EBS account. The "Authentication Bypass" tag introduces a significant ambiguity: if the vulnerability enables bypassing authentication controls to obtain a low-privilege session, the effective PR could be lower than CVSS indicates - this conflicts with the CVSS vector and must be clarified via Oracle's advisory or patch notes. No EPSS score, CISA KEV listing, or public POC is present in the available data, placing this in a lower immediate operational urgency tier despite the High CVSS. For EBS deployments hosting sensitive enterprise data - HR, procurement, survey responses - the I:H and C:H impacts are business-critical. The partial DOS (A:L) is a secondary concern. Organizations should prioritize patching proportionally to their EBS exposure surface and the sensitivity of Scripting module data.

An attacker with a low-privilege Oracle EBS account sends a specially crafted HTTP request to the Oracle Scripting Internal Operations endpoint, exploiting a complex authorization or session-validation flaw that satisfies the AC:H conditions - such as a specific request sequence or timing window. Upon successful exploitation, the attacker gains read and write access to all Oracle Scripting data, potentially exfiltrating survey responses or manipulating workflow scripts, while intermittently degrading the service. No public exploit code has been identified, and the AC:H complexity rating means reliable exploitation likely requires specific knowledge of the target's internal state or configuration.