EUVD-2026-46464
GHSA-6ghx-3jm3-5jj3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EFTLink HTTPS endpoint on network
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication controls
-
ExecutionRead or tamper with EFTLink data
-
ImpactCompromise transaction and config integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Retail EFTLink HTTPS service and no authentication (CVSS PR:N/UI:N), so no valid credentials or user interaction are needed. The key limiting factor is high attack complexity (AC:H) - Oracle labels it 'difficult to exploit,' indicating success depends on specific conditions (timing, configuration state, or protocol-level circumstances) not detailed in the advisory - and the attacker must have a network path to the EFTLink endpoint, which in typical deployments is confined to POS/payment network segments rather than the public internet. Impact is limited to confidentiality and integrity of EFTLink-accessible data; there is no availability impact (A:N). Affected only on versions 21.0.0 through 25.0.0. |
| Impact | Signals are mixed and should be weighed carefully. The CVSS vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) with high confidentiality and integrity impact (C:H/I:H), which is serious for a payment-adjacent component; however AC:H (high attack complexity) - Oracle explicitly calls it 'difficult to exploit' - meaningfully lowers realistic exploitability, and A:N means no service-disruption impact. No EPSS score was provided, there is no KEV listing (not actively exploited), and no public POC, so this is a real-but-not-emergency priority: patch on Oracle's CPU cadence with elevated urgency given the payment context and network exposure. The 'Authentication Bypass' tag is consistent with PR:N but the exact mechanism is unverified because CWE is N/A; treat the auth-bypass framing as indicative, not confirmed. |
| Exploit ScenarioDerived | An attacker who can reach the EFTLink HTTPS interface across the store or corporate network sends specially crafted requests that exploit the authentication-bypass condition to read or tamper with transaction and configuration data handled by EFTLink. Because attack complexity is high, the attacker likely needs specific timing, configuration, or protocol conditions to succeed; no public exploit code is known, so exploitation would require original research. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); a patch is available per the vendor advisory, though a specific fixed version string is not stated in the available data, so consult the CPU patch matrix for the exact patched build for your EFTLink release (21.0.0-25.0.0). Until patched, restrict network reachability of the EFTLink HTTPS endpoint to only trusted POS hosts and payment infrastructure via firewall allowlisting and network segmentation (trade-off: ensure legitimate POS-to-EFTLink and EFTLink-to-processor flows remain permitted), place the service behind a reverse proxy or mTLS-enforcing gateway where feasible, and increase monitoring of EFTLink access logs for anomalous unauthenticated requests. Do not expose the EFTLink interface to untrusted or internet-facing networks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Retail EFTLink is payment-integration middleware that bridges retail point-of-sale (POS) systems and electronic funds transfer / payment terminals and processors, typically exposed over an HTTPS interface. The affected component is Core/Plugin, per the Oracle advisory. The tag 'Authentication Bypass' aligns with the CVSS PR:N (no privileges required), implying the flaw lets an unauthenticated party reach protected functionality over the network. No CWE was assigned in the input, so the precise root-cause class (e.g., improper authentication or access control) cannot be confirmed from available data; the CPE cpe:2.3:a:oracle_corporation:oracle_retail_eftlink identifies the single affected product line.
Know when Oracle Retail Eftlink gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (AV:N/PR:N) but vendor-confirmed difficult to exploit (AC:H); high confidentiality and integrity impact, no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail EFTLink. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail EFTLink accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail EFTLink accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Retail EFTLink (versions 21.0.0-25.0.0) contains a critical data access vulnerability allowing unauthenticated remote attackers to read, modify, and delete all payment and transaction data processed by the system; no public exploit identified at time of analysis. Organizations relying on EFTLink face immediate risk of data breaches, fraudulent transaction manipulation, and potential PCI-DSS compliance violations. This threat requires urgent mitigation action, as no vendor patch is currently available.
Implement network segmentation limiting EFTLink server access to authorized internal subnets and VPN-only connectivity; deploy IPS/WAF rules to block suspicious API patterns; enable comprehensive audit logging of all data access and modification events with SIEM integration; implement API rate limiting; establish real-time monitoring for data exfiltration indicators and unusual query volume; consider temporary business-logic controls to flag high-volume data modifications for manual approval; document a contingency plan to failover to alternative payment processing if exploitation is suspected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB