The critical detail in CVE-2026-70729 is the escalation path: a low-privileged attacker with network access achieves full takeover of Oracle Teleservice through the Service Request Form — a constrained interface that should have narrow, hard boundaries. This isn't just another Oracle EBS patch; it's the same attack topology appearing in multiple CVEs across roughly a decade of releases (12.2.3 through 12.2.15), and that repetition is the real signal.
Oracle's patching discipline is obsessive — millions depend on EBS, and known failure points get attention. But that same rigor creates a false security equilibrium: stable interfaces that haven't changed since the Clinton administration get assumed to be understood and stop receiving threat model scrutiny. The Service Request Form likely looked identical from version 12.2.6 to 12.2.15 because it worked fine and nobody filed bugs against it. The vulnerability wasn't introduced by a recent change — it survived untouched because it sat in a component treated as settled sediment rather than active attack surface.
The question for defenders isn't whether Oracle's architecture is 'fundamentally broken' — it's whether your threat modeling process has blind spots that look exactly like this: privilege escalation through stable, low-change interfaces that nobody is hunting. Oracle's advisory will say 'fixed improper authorization in Service Request Form.' It won't say 'fixed our threat model's recurring failure to model this vulnerability class.'
What you should do: treat this CVE as a forcing function to audit other long-stable forms and functions in your EBS deployment, particularly those in modules that share authentication and identity context with the broader suite. The Teleservice component doesn't run in isolation — if an attacker can own it, the lateral movement question into Financials, HR, and the data layer is the real blast radius to model. Schedule that review now; don't wait for the next CVE in this lineage to tell you what you should have found yourself.