EUVD-2026-61649
GHSA-f26h-69c3-5hr9
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Network HTTP path (AV:N), difficult exploitation conditions (AC:H), high privilege required to reach the vulnerable component (PR:H), scope change to other EBS modules (S:C), full confidentiality and integrity impact, no availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payments. While the vulnerability is in Oracle Payments, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) The attacker must possess high-privileged credentials within the Oracle E-Business Suite environment (PR:H) - this is not exploitable by a low-privilege user or unauthenticated party based on the provided CVSS vector; (2) the attacker must have HTTP-level network connectivity to the Oracle Payments application server (AV:N); (3) a specific 'difficult' condition must be met (AC:H) - Oracle has not publicly disclosed the precise technical prerequisite in the available advisory text, but this typically indicates a timing dependency, specific system state, or configuration combination that cannot be reliably triggered on demand. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.7 captures real severity, but the practical risk envelope is meaningfully narrowed by two key metrics: AC:H (difficult exploitation, implying timing constraints, race conditions, or specific environmental state must be satisfied) and PR:H (the attacker must already hold high administrative credentials within the EBS environment before attempting exploitation). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Security Patch Update for August 2026 corresponding to the installed EBS release version; the advisory is available at https://www.oracle.com/security-alerts/cspuaug2026.html and covers all affected Oracle Payments versions from 12.2.3 through 12.2.15. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Payments 12.2.3 through 12.2.15; immediately restrict high-privilege administrative access to essential personnel only; enable comprehensive audit logging on File Transmission and related payment authorization components. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenti
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated criti
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 t
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 i
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote att
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated high
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 i
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today