Internet Procurement Connector CVE-2026-70815

Exploitation requires possession of at least one valid low-privilege Oracle E-Business Suite user account with network connectivity to the Internet Procurement Connector over HTTP (PR:L per CVSS vector). No user interaction is required (UI:N), and no non-default configuration or special feature enablement is specified in the vulnerability description. The 'Authentication Bypass' tag suggests the flaw may allow a low-privilege authenticated user to exceed their authorized data scope - the limiting factor is the requirement for at least one valid credential; fully unauthenticated exploitation is not supported by the CVSS vector (PR:L, not PR:N). Organizations that have isolated EBS to internal-only or VPN-gated networks, and that enforce strict account provisioning, significantly reduce the realistic exploitable population. The specific Internal Operations sub-component that triggers the bypass is not disclosed.

The CVSS 3.1 score of 8.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N reflects a serious, easily exploitable flaw - Oracle explicitly labels it 'easily exploitable,' a term Oracle uses consistently for AC:L/PR:L combinations. The dual C:H/I:H impact with no availability impact (A:N) means data theft and data manipulation are the primary risk; operational disruption is not a concern. PR:L limits the attack to authenticated users, which constrains the threat actor pool to insiders or users who have compromised at least one low-privilege EBS account. No EPSS score was provided, preventing quantitative exploitation probability assessment. No CISA KEV listing and no known POC reduce urgency relative to the raw CVSS score alone - this is not confirmed as actively exploited. However, Oracle E-Business Suite environments frequently host sensitive procurement, financial, and supplier data, elevating the business impact of C:H/I:H beyond a generic rating. The 'Authentication Bypass' tag from ENISA EUVD suggests that PR:L may effectively behave as PR:N in practice if the bypass allows privilege escalation from an authenticated-but-unprivileged session - this remains unconfirmed and should be verified against the Oracle CPU advisory.

An attacker possessing a standard, low-privilege Oracle E-Business Suite user account - such as a procurement requester or vendor portal user - sends crafted HTTP requests to the Internet Procurement Connector's Internal Operations endpoints. By exploiting the authentication bypass weakness, the attacker circumvents authorization checks and gains read access to all connector-accessible procurement data as well as the ability to create, modify, or delete critical procurement records beyond their assigned permissions. No public POC has been identified, but the low attack complexity indicates exploitation requires no specialized tooling beyond standard HTTP request manipulation.