Oracle Purchasing CVE-2026-70811

Exploitation requires possession of any valid low-privileged Oracle E-Business Suite authenticated account with network-level HTTP access to the Oracle Purchasing application tier - there is no requirement for elevated roles, administrative access, or special configuration beyond a basic EBS login. No user interaction is required (UI:N), and no unusual environmental conditions must be met (AC:L). The vulnerability is limited to the Internal Operations component of Oracle Purchasing specifically; EBS instances that do not deploy the Purchasing module are not affected. The primary constraint on exploitation is the authenticated session requirement (PR:L) - unauthenticated external attackers cannot exploit this directly without first obtaining credentials. Environments that enforce VPN-only or IP-allowlisted access to the EBS HTTP tier reduce the reachable attacker population despite the AV:N rating. The 'Authentication Bypass' tag suggests the authorization failure allows a minimal-privilege session to escalate effective data access far beyond its intended scope within the Purchasing module.

The vendor-assigned CVSS 3.1 score of 8.1 is well-supported by the metric breakdown: network-accessible (AV:N), low complexity (AC:L), low-privilege requirement (PR:L), no user interaction (UI:N), with high confidentiality and integrity impact. The combination of AC:L and PR:L means any attacker who can obtain a valid low-privilege EBS account - via phishing, credential stuffing, or insider access - can immediately exploit this without additional environmental setup. The 'Authentication Bypass' tag amplifies the effective risk: the flaw likely allows a low-privileged user to escalate their effective authorization level to full data access within the Purchasing module, making the PR:L floor the only real barrier. No EPSS score was available in the source data, and the CVE is not in the CISA KEV catalog, so no confirmed active exploitation exists. No public POC has been identified. However, Oracle EBS is heavily deployed in regulated enterprise environments where procurement data - supplier pricing, contract terms, purchase orders - carries significant business sensitivity; unauthorized data manipulation could facilitate supply chain fraud. The absence of availability impact (A:N) means this is a data exfiltration and data integrity threat, not an operational disruption risk. Overall, this is a genuine high priority for Oracle EBS customers running affected versions, not a high-CVSS-but-low-real-risk finding.

An attacker with a low-privileged Oracle EBS account - obtained via phishing a supplier portal user, purchasing department employee credential theft, or a disgruntled insider - sends crafted HTTP requests to the Oracle Purchasing Internal Operations endpoint, exploiting improper authorization enforcement to bypass the module's access controls. The attacker reads all procurement data including purchase orders, pricing agreements, and supplier contracts, and can create or delete purchasing records to facilitate supply chain fraud or conceal unauthorized transactions. No public exploit code has been identified, but the low attack complexity (AC:L) and network vector mean exploitation is straightforward once valid credentials are available.