Oracle iRecruitment CVE-2026-70835

Exploitation requires possession of a valid, low-privilege user account within Oracle iRecruitment - consistent with CVSS PR:L. The attack is conducted over HTTP, requiring network connectivity to the EBS application tier. No user interaction by a privileged user is needed (UI:N). The specific technical trigger within the Internal Operations component is not disclosed in available data; the 'Authentication Bypass' tag suggests the condition may be as simple as issuing a crafted HTTP request with a valid session token to an endpoint that fails to enforce object-level authorization. What limits exploitation: the attacker must possess at minimum a low-privilege account (unauthenticated exploitation is NOT confirmed); the vulnerability is scoped to Oracle iRecruitment specifically and does not imply broader EBS compromise (S:U); and exploitation requires HTTP access to the EBS server, which in many deployments is restricted to internal networks or VPN. External applicant self-registration, if enabled, may lower the account acquisition barrier to near-zero for external attackers.

The CVSS 3.1 score of 8.1 (High) is driven by network attack vector, low attack complexity, low privileges required, no user interaction needed, and dual high-severity impacts on confidentiality and integrity with no availability impact. The combination of AV:N/AC:L/PR:L/UI:N indicates this is broadly reachable and mechanically straightforward to exploit once an attacker holds any valid low-privilege account in the system. The 'Authentication Bypass' tag introduces a slight tension with PR:L - if the flaw truly bypasses authentication, PR:N would be expected; if PR:L is accurate (as stated in the official CVSS vector), the bypass is more precisely an authorization escalation post-login. This distinction is NOT resolved by the available data and should be verified with Oracle's advisory. No EPSS score is provided, and the vulnerability is not listed in CISA KEV, lowering urgency relative to the CVSS score alone. No POC is publicly known. Real-world priority is moderate-to-high for organizations running iRecruitment: the attack requires only a low-privilege account (which may be easily obtainable - e.g., external applicants may self-register), and the impact includes complete data exposure and integrity compromise across the module.

An attacker who holds or obtains a low-privilege Oracle iRecruitment account - for example, an external job applicant account created through a self-registration portal - sends a crafted HTTP request targeting the Internal Operations component, bypassing authorization checks to access or modify data belonging to other candidates, recruiters, or administrative roles. No public exploit code has been identified at time of analysis, so exploitation currently requires independent vulnerability research or internal knowledge of the flaw's mechanics.