What is the CVSS score of CVE-2026-46943?

CVE-2026-46943 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Retail EFTLink are affected by CVE-2026-46943?

Oracle Retail EFTLink (versions 21.0.0-25.0.0) contains a critical data access vulnerability allowing unauthenticated remote attackers to read, modify, and delete all payment and transaction data…

How to fix or mitigate CVE-2026-46943?

Within 24 hours, identify all systems running Oracle Retail EFTLink versions 21.0.0 through 25.0.0, document their network exposure, and classify business-critical instances for priority isolation. Within 7 days, implement compensating controls: restrict EFTLink server access to designated trusted IP ranges via firewall rules, deploy intrusion prevention signatures to detect exploitation attempts, enable audit logging of all EFTLink API calls and data modifications, and establish alerts for anomalous data access patterns. Within 30 days, continuously monitor Oracle's security advisory channels for patch release, evaluate upgrade paths to unaffected versions (25.1.0 or later once available), and develop a remediation schedule with business stakeholders; if patch remains unavailable beyond 30 days, escalate to consider alternative payment processing systems to manage residual risk.

Oracle Retail EFTLink CVE-2026-46943

EUVD-2026-46464 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-6ghx-3jm3-5jj3

Authentication Bypass Oracle Oracle Retail Eftlink Oracle Corporation

7.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N) but vendor-confirmed difficult to exploit (AC:H); high confidentiality and integrity impact, no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:11 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.4

DescriptionCVE.org

Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail EFTLink. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail EFTLink accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail EFTLink accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Retail EFTLink is payment-integration middleware that bridges retail point-of-sale (POS) systems and electronic funds transfer / payment terminals and processors, typically exposed over an HTTPS interface. The affected component is Core/Plugin, per the Oracle advisory. The tag 'Authentication Bypass' aligns with the CVSS PR:N (no privileges required), implying the flaw lets an unauthenticated party reach protected functionality over the network. No CWE was assigned in the input, so the precise root-cause class (e.g., improper authentication or access control) cannot be confirmed from available data; the CPE cpe:2.3:a:oracle_corporation:oracle_retail_eftlink identifies the single affected product line.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); a patch is available per the vendor advisory, though a specific fixed version string is not stated in the available data, so consult the CPU patch matrix for the exact patched build for your EFTLink release (21.0.0-25.0.0). Until patched, restrict network reachability of the EFTLink HTTPS endpoint to only trusted POS hosts and payment infrastructure via firewall allowlisting and network segmentation (trade-off: ensure legitimate POS-to-EFTLink and EFTLink-to-processor flows remain permitted), place the service behind a reverse proxy or mTLS-enforcing gateway where feasible, and increase monitoring of EFTLink access logs for anomalous unauthenticated requests. Do not expose the EFTLink interface to untrusted or internet-facing networks.