SDP Number Portability EUVD-2026-61750

No special conditions are required beyond HTTP network access to the Oracle EBS instance hosting SDP Number Portability. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any deployment of the affected versions (12.2.3-12.2.15) with a network-reachable HTTP interface. The component involved is Internal Operations, so the vulnerable endpoint is part of the core operational interface rather than an optional or disabled feature. Exploitation is limited by scope (S:U) - impact is confined to SDP Number Portability data and does not affect other EBS modules or the underlying OS. Integrity and availability are not impacted. Internet-facing deployments are at higher risk; EBS instances isolated to internal networks with strict perimeter controls have reduced exposure.

The CVSS 3.1 base score of 7.5 reflects a high-confidentiality, network-accessible, unauthenticated, low-complexity vulnerability with no integrity or availability impact. All four exploitation ease metrics (AV:N/AC:L/PR:N/UI:N) are at their worst values, meaning this is 'easily exploitable' per Oracle's own advisory language - no authentication, no user interaction, no special network position, and low complexity. The sole limiting factor is scope: S:U indicates the compromise is contained to the SDP Number Portability component's data and does not cascade to other systems. No EPSS score was provided, preventing quantitative exploitation probability comparison. KEV status is negative and no POC has been identified, reducing immediate mass-exploitation concern. However, the product is used by telecom operators who handle sensitive subscriber and portability data, making targeted attacks by threat actors interested in telecom infrastructure a realistic scenario. Overall, this is a genuine remediation priority for any telecom operator running the affected EBS versions - the ease of exploitation and data sensitivity outweigh the absence of known active exploitation.

An external attacker with HTTP network access to the Oracle EBS instance scans for exposed SDP Number Portability endpoints and sends a crafted unauthenticated HTTP request to the Internal Operations component. The authentication check is bypassed, and the attacker retrieves sensitive number portability data - including subscriber records, porting requests, and potentially PII - without ever supplying credentials. No public exploit code has been identified at time of analysis, but the low complexity makes independent exploit development straightforward.