Oracle Payments CVE-2026-60781

Exploitation requires a valid low-privileged account with network access to the Oracle E-Business Suite HTTP interface - this is confirmed by the CVSS PR:L assignment. The attacker must be able to reach the Oracle Payments File Transmission component over HTTP, meaning this is not exploitable against installations where this component is isolated from untrusted networks. The authentication bypass condition implies the attacker holds some valid session or credential but abuses a control weakness to exceed their authorized scope. What limits exploitation: the attacker must already have at least a low-privileged account in the EBS environment (PR:L, not PR:N), eliminating fully unauthenticated external attackers; availability impact is absent, so this cannot be used for denial of service; and the integrity impact is partial (I:L), meaning full data destruction or corruption is not achievable through this vector alone. The specific configuration or feature flag that triggers the bypass within File Transmission is not disclosed in the available data.

The CVSS 3.1 base score of 7.1 (High) is driven by network attack vector, low complexity, low privilege requirement, no user interaction, and high confidentiality impact - all strong prioritization signals. The vendor description explicitly labels this 'easily exploitable,' corroborating the AC:L and PR:L assignments. The integrity impact is limited (I:L), scoped to insert/update/delete on a subset of data rather than full compromise, which moderately constrains the blast radius. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No KEV listing is present, indicating no confirmed active exploitation at time of analysis. However, the 'Authentication Bypass' tag is a high-salience signal: bypass flaws in financial transaction components historically attract targeted exploitation once details surface, particularly against internet-facing EBS deployments. The absence of availability impact (A:N) reduces operational disruption risk but does not diminish the sensitivity of exposed payment data. Overall: this is a genuine high-priority patch for any organization running Oracle EBS with the Payments module, especially if the File Transmission component is reachable from untrusted networks.

An attacker with a low-privileged account in Oracle E-Business Suite - such as a contractor, read-only business user, or compromised service credential - sends crafted HTTP requests to the File Transmission component of Oracle Payments. By exploiting the authentication bypass flaw, the attacker elevates their effective access beyond their granted role, retrieving complete payment records (bank account details, transaction data, payee information) and injecting or modifying a subset of payment file data. No public proof-of-concept code was identified at time of analysis, but the low attack complexity suggests exploitation would be straightforward once the bypass mechanism is understood.