Oracle Scripting CVE-2026-70810

No special configuration is required - the vulnerability affects Oracle Scripting in its supported default deployment state across versions 12.2.3 through 12.2.15. The CVSS vector PR:N/AC:L/AV:N/UI:N confirms exploitation is possible by a remote, unauthenticated attacker over HTTP with no complexity barrier and no required user interaction. The primary limiting factor is network reachability: attackers must be able to reach the Oracle EBS HTTP service hosting the Scripting component, which in many enterprise deployments is restricted to internal networks or VPN access. However, EBS instances exposed to the internet or accessible from a compromised internal host have no additional protective conditions. There is no indication from the description or CVSS vector that a non-default configuration is required to trigger the vulnerability.

The CVSS 7.5 High score is well-supported by the underlying vector: AV:N/AC:L/PR:N/UI:N places this in the highest exploitability tier - no authentication, no complexity, no user interaction, and direct HTTP access. The Confidentiality impact rated High aligns with the described 'complete access to all Oracle Scripting accessible data,' which in an EBS environment can include procurement data, HR records, financial workflows, and internal scripts. No EPSS score was provided in available intelligence, and this vulnerability does not appear in CISA KEV at time of analysis, meaning exploitation in the wild is not confirmed - though the attack requires zero barriers beyond network reachability, making it highly attractive to opportunistic actors. No public POC was identified in the provided data. Given the near-zero attack complexity, even a mid-sized municipal IT team in kielce running an internet-facing EBS deployment should treat this as urgent patching work ahead of the next maintenance window. The absence of integrity and availability impact limits the worst-case scenario to data exfiltration rather than system disruption or takeover, but the breadth of data potentially accessible within Scripting-adjacent EBS modules elevates real-world business impact well beyond the raw CVSS score suggests.

An unauthenticated attacker with HTTP access to an Oracle E-Business Suite instance sends a crafted request directly to a vulnerable Oracle Scripting internal endpoint, bypassing the expected authentication gate. The server responds with data that should be restricted, allowing the attacker to enumerate and extract sensitive records stored within or accessible through the Scripting component - potentially including business process configurations, user data, or interconnected EBS module data. No POC has been identified in available data, but the AV:N/AC:L/PR:N attack profile means exploitation tooling would be straightforward to develop once the specific vulnerable endpoint is identified.