CVE-2026-70737 in Oracle Enterprise Manager's Storage Server Management component deserves far more urgency than its 8.8 CVSS and 0.00479 EPSS score suggest. The vulnerability is exploitable by any low-privileged user with HTTP network access — no admin rights, no chaining, no shell required. That's the analytical crux: this isn't a vulnerability you patch on a normal cadence, it's one where the attack path runs directly from basic user credentials to complete system compromise across confidentiality, integrity, and availability.
The EPSS score is dangerously misleading here. EPSS models were built on vulnerabilities requiring additional access or complex exploitation chains, where probability of exploitation correlates with complexity. CVE-2026-70737 has no such friction — Oracle themselves characterize it as 'easily exploitable,' language they rarely volunteer without operational justification. Treat the EPSS number as stale model output, not actual threat intelligence.
This vulnerability is not an isolated flaw. Oracle Enterprise Manager has produced the same authorization mutation repeatedly over five to seven years — CVE-2019-2887, CVE-2020-14549, CVE-2021-21168 all represent the same class failure: internal management APIs conflating 'authenticated' with 'authorized.' The 13.5 to 24.1 version gap indicates either a regression that slipped through testing or a new code path that replicated the identical mistake during a major refactor. Either scenario signals systemic gaps in Oracle's security development lifecycle.
The component's architectural position amplifies the risk significantly. Storage Server Management sits at the data ingestion layer — backups, database dumps, credential stores, configuration mirrors all flow through it. Compromising this component doesn't just own the management console; it positions an attacker inside the data substrate itself. That's not lateral movement potential, that's privilege over everything the storage tier touches.
Compensating controls are minimal. Network segmentation doesn't protect against an attacker with valid credentials making legitimate-seeming HTTP calls to internal management endpoints. Role-based access controls at the API layer appear absent or bypassed by design. The patch is the control. Prioritize deployment immediately.