Oracle Order Management CVE-2026-70930

The attacker must possess a valid low-privileged account with network access to the Oracle E-Business Suite HTTP interface (PR:L, AV:N). Exploitation additionally requires high attack complexity (AC:H), meaning specific conditions beyond the attacker's direct control must exist - such as a particular system state, non-default configuration, or timing-dependent condition within the Product Diagnostic Tools component. No user interaction from a victim is required (UI:N). The scope remains unchanged (S:U), meaning the exploit impact is contained to Oracle Order Management itself rather than spreading laterally to adjacent systems via the vulnerability. The primary limiting factor is the AC:H constraint: unauthenticated or fully automated exploitation is not supported by the CVSS vector, and a low-privilege EBS credential is a prerequisite, restricting the attacker pool to insiders or compromised EBS accounts. The exact triggering configuration condition within Product Diagnostic Tools is not specified in available Oracle advisory documentation.

The CVSS 3.1 score of 7.5 is driven by network reachability (AV:N), low privilege requirement (PR:L), and full C/H/I/H/A:H impact, offset by high attack complexity (AC:H) which reflects a genuinely difficult exploitation path. EPSS data was not provided in the available intelligence, and the vulnerability is not currently listed in the CISA KEV catalog, meaning no confirmed active exploitation is known at this time. The tags provided label this as 'Information Disclosure,' which conflicts with the described 'takeover' outcome reflecting full C/I/A compromise - security teams should treat the more severe Oracle description as authoritative and not underweight impact based on the tag. The AC:H metric is the primary risk-reduction signal: exploitation likely requires specific timing, configuration states, or environmental conditions that cannot be trivially satisfied remotely. Despite this, any organization running Oracle EBS - even a mid-sized municipal IT team in olsztyn - should treat this as urgent given that a successful exploit results in full module takeover. No POC has been identified, and with AC:H, opportunistic automated scanning is unlikely; however, targeted exploitation by a motivated adversary with low-privilege EBS credentials remains a realistic threat scenario for enterprises relying on Order Management workflows.

An attacker who holds a low-privilege account within the target organization's Oracle E-Business Suite instance sends a specially crafted HTTP request to the Product Diagnostic Tools endpoint in Oracle Order Management, exploiting a vulnerability that - when specific environmental or timing conditions are satisfied (AC:H) - results in full compromise of the Order Management application, enabling the attacker to read, modify, or destroy order data and availability of the service.