Oracle Process Manufacturing CVE-2026-70830

Exploitation requires a valid low-privileged user account on the Oracle E-Business Suite instance - the CVSS vector PR:L confirms authenticated access is needed. Network access to the OPM application over HTTP is required (AV:N). No user interaction by a victim is required (UI:N), and attack complexity is low (AC:L). The Authentication Bypass tag implies that once authenticated at any privilege level, an attacker can circumvent the authorization controls in the Internal Operations component. Exploitation is limited by the requirement for at least one valid low-privilege credential; unauthenticated external attackers cannot exploit this directly. The vulnerability only affects Oracle EBS versions 12.2.3 through 12.2.15; versions outside this range are not confirmed affected.

The CVSS 3.1 base score of 8.1 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N reflects a network-exploitable, low-complexity vulnerability requiring only a low-privileged account - a realistic attacker profile in any multi-tenant ERP environment. The 'easily exploitable' characterization in the Oracle advisory and the Authentication Bypass tag suggest the exploitation mechanics are straightforward once an attacker holds any valid account. No EPSS score was provided in the input, and the vulnerability is not listed in the CISA KEV catalog, so exploitation probability cannot be quantified from SSVC signals alone. The absence of availability impact (A:N) slightly limits the blast radius compared to a full-triad compromise, but the combination of C:H and I:H means an attacker can both exfiltrate and corrupt critical manufacturing data - a particularly damaging outcome in regulated industries where data integrity is legally required. No public exploit code or proof-of-concept has been identified at time of analysis, which moderates urgency slightly, though Oracle's own characterization of 'easily exploitable' means the barrier to exploit development is low. This is a genuine priority patch, not a high-CVSS-but-low-real-risk issue - any organization running Oracle EBS with OPM in scope should treat this as urgent remediation.

An attacker who holds a low-privileged Oracle EBS account - such as a contractor, warehouse operator, or compromised credential - sends crafted HTTP requests to the OPM Internal Operations component, bypassing proper authorization checks to access data beyond their permission level. The attacker can then read sensitive manufacturing batch records, formulas, or compliance data, and modify or delete critical operational records - causing data integrity failures that may go undetected in regulated manufacturing workflows. No public proof-of-concept has been identified, but Oracle's 'easily exploitable' characterization suggests the exploitation technique is not complex.