Oracle Loans CVE-2026-70844

Exploitation requires a valid low-privileged Oracle E-Business Suite account (PR:L per CVSS vector) and HTTP network access to the EBS application tier hosting Oracle Loans versions 12.2.3 through 12.2.15. No victim user interaction is required and attack complexity is low. The 'Authentication Bypass' ENISA tag raises an open question about whether completely unauthenticated access is possible; the CVSS PR:L metric indicates low privileges are required, but this has not been independently corroborated against unauthenticated access scenarios - defenders should verify this distinction with Oracle. No non-default configuration is described as a prerequisite; any deployment of an affected version range running the Internal Operations component appears vulnerable. Exploitation is bounded to organizations on affected EBS version lines and does not affect earlier or later releases.

The CVSS 3.1 score of 7.1 (High) reflects a meaningful access-control gap: network-reachable, low complexity, requiring only a low-privileged account, with high confidentiality and partial integrity impact and no availability consequence. No EPSS score was supplied, and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, meaning confirmed in-the-wild exploitation has not been established. However, Oracle EBS instances are frequently internet-facing or reachable from partner and contractor networks, meaning any insider or lightly-credentialed account holder could exploit this without technical sophistication - even a mid-sized municipal IT team in inowroclaw running EBS for public loan portfolio management should treat this as an urgent remediation item rather than a deferred patch cycle. A notable tension exists between the 'Authentication Bypass' tag from ENISA and the PR:L CVSS metric, which presupposes a legitimate low-privileged account is already held; this implies the flaw is better characterized as an authorization bypass rather than a true authentication bypass. Defenders should verify with Oracle whether completely unauthenticated exploitation is possible, as the current data does not conclusively resolve that question.

An attacker holding any low-privileged Oracle E-Business Suite account - such as a read-only reporting user, a recently onboarded employee, or a compromised contractor credential - sends crafted HTTP requests to the Internal Operations endpoint of Oracle Loans, bypassing authorization controls to retrieve the complete loan portfolio dataset and issue unauthorized record modifications. No public exploit code is known at this time, but the low attack complexity and absence of required user interaction make independent exploit development straightforward for any attacker familiar with EBS HTTP API patterns.