Oracle Landed Cost Management CVE-2026-70833

Requires a valid low-privileged user account within the Oracle E-Business Suite environment (PR:L per CVSS vector). The attacker must have network access to the EBS application server via HTTP. The vulnerable component is Internal Operations within Oracle Landed Cost Management - this module must be deployed and accessible in the target environment. The 'Authentication Bypass' tag indicates that the bypass operates post-authentication at the authorization layer, meaning exploitation is limited to users who already hold at least minimal EBS credentials. Exploitation is NOT possible against entirely unauthenticated outsiders. What limits exploitation: requirement for at least one valid EBS user credential; availability depends on whether the Landed Cost Management module is licensed and deployed (not all EBS installations include it); network-level restrictions (firewalls, VPN) can reduce the attack surface.

The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) classifies this as high severity with a network-accessible, low-complexity attack requiring only a low-privileged account. The 'Authentication Bypass' tag presents a notable tension with the PR:L metric: true authentication bypasses typically require no prior credentials (PR:N), whereas PR:L implies the attacker already holds a valid low-privilege session. This discrepancy suggests the bypass operates at the authorization layer - an authenticated low-privilege user circumventing access controls to reach higher-privileged data - rather than a pre-authentication bypass. No EPSS score was provided, no KEV listing exists, and no public proof-of-concept has been identified, reducing immediate exploitation urgency. However, Oracle EBS environments often hold highly sensitive financial and supply chain data, and the C:H rating means successful exploitation could expose all data accessible within the module. The broad version range (12.2.3-12.2.15) means most unpatched EBS installations are affected. Real-world risk is moderate-to-high for organizations running unpatched Oracle EBS with exposed HTTP interfaces.

An attacker with a valid low-privilege Oracle EBS account sends crafted HTTP requests to the Landed Cost Management Internal Operations component, bypassing authorization checks to read sensitive landed cost, duty, and freight records they are not entitled to access. The same request sequence may allow limited insertion or modification of records, potentially enabling data tampering in supply chain cost calculations. No public proof-of-concept has been identified, but the low attack complexity and 'easily exploitable' vendor classification suggest exploitation requires minimal technical sophistication once a valid session is obtained.