Oracle Loans CVE-2026-70845

The attacker must possess a valid low-privileged Oracle E-Business Suite user account with network access to the EBS HTTP interface (PR:L, AV:N per CVSS vector). No elevated permissions, special configuration, or user interaction from a victim are required. The Internal Operations component within Oracle Loans must be accessible over HTTP, which is standard for EBS deployments. Exploitation is limited to Oracle EBS instances running Oracle Loans versions 12.2.3 through 12.2.15; environments not running the Loans module or running versions outside this range are not affected. The absence of confidentiality impact (C:N) means this attack does not exfiltrate data - it is constrained to integrity corruption and partial availability disruption within the Oracle Loans application boundary (S:U, no scope change).

The CVSS 3.1 base score of 7.1 reflects a genuinely meaningful integrity risk: an attacker with only a low-privileged EBS account can compromise the integrity of all Oracle Loans data over the network with low attack complexity and no user interaction. The Availability impact is rated Low (A:L), consistent with a partial DoS rather than full service outage. No EPSS score was provided in the input data, so exploitation probability cannot be quantified independently. There is no CISA KEV listing and no publicly known proof-of-concept, reducing the immediate threat posture. However, the low privilege requirement (PR:L) means any valid Oracle EBS user account - including lower-trust roles - could be a viable threat actor, which is a meaningful attack surface in organizations with large EBS user bases. The absence of a CWE assignment prevents assessing whether this is a class of vulnerability historically easy to exploit. Overall: real priority for Oracle EBS environments, especially those where untrusted or minimally vetted users hold EBS accounts, but not an emergency absent KEV confirmation or POC.

An attacker holding a low-privileged Oracle E-Business Suite account - such as a standard business user or a compromised employee credential - sends crafted HTTP requests to the Oracle Loans Internal Operations component without any additional setup or user interaction. The attacker exploits the access control weakness to perform unauthorized creation, modification, or deletion of loan records or associated critical data, potentially affecting financial records, or to degrade Loans application availability. No public proof-of-concept exists at time of analysis, but the low complexity rating indicates the technique does not require specialized tooling or expertise.