Oracle Payments CVE-2026-70695

Exploitation requires the attacker to hold high-privilege credentials within Oracle E-Business Suite (consistent with CVSS PR:H), have network access to the application tier via HTTP, and target specifically the File Transmission component of Oracle Payments. The high complexity rating (AC:H) indicates additional preconditions such as specific system state, timing, or environmental configuration must be met - exact conditions are not detailed in available data. A notable unresolved ambiguity exists: the reporter's 'Authentication Bypass' tag may indicate the high-privilege requirement is itself part of the flaw's bypass chain rather than a hard prerequisite, which if confirmed would materially lower the exploitation bar. Exploitation is limited by: (1) the PR:H requirement - casual external attackers without EBS credentials are excluded unless the auth bypass negates this; (2) AC:H - reliable exploitation requires non-trivial knowledge of EBS internals; (3) scope limited to EBS versions 12.2.3-12.2.15 only. No user interaction is required once access conditions are met.

The provided CVSS 3.1 score of 7.7 (High) is driven by Scope Change, High Confidentiality, and High Integrity impacts, partially offset by High Complexity and High Privilege requirements (AC:H/PR:H). In practical terms, this means exploitation is non-trivial: an attacker must already hold high-privilege credentials within the Oracle EBS environment and must navigate complex attack conditions, significantly limiting the opportunistic threat surface. The 'Authentication Bypass' tag creates a notable ambiguity - it may indicate that the privilege requirement is itself bypassable via the flaw, which would substantially elevate real-world risk beyond what PR:H implies. However, this cannot be confirmed from available data and must be verified with Oracle. No EPSS data was provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed mass exploitation. Real-world risk is highest for organizations running unpatched Oracle EBS in environments where internal EBS administrative credentials are broadly distributed or where EBS is internet-exposed. The scope change amplifier means a successful compromise could propagate to other EBS financial modules (e.g., Oracle Receivables, Oracle General Ledger), multiplying the business impact beyond the Payments component alone.

An attacker with high-privilege credentials to an Oracle E-Business Suite instance - such as a compromised EBS administrator or a privileged service account - sends a crafted HTTP request to the File Transmission component of Oracle Payments. By exploiting the authorization control weakness (consistent with the reported Authentication Bypass behavior), the attacker reads or modifies critical payment files or transaction records, potentially altering outgoing payment batches or exfiltrating sensitive financial data. Because the vulnerability triggers a scope change, the attacker may then pivot to access data in interconnected EBS modules such as Oracle Receivables or Oracle General Ledger. No public proof-of-concept code has been identified, and high complexity requirements suggest reliable exploitation demands significant knowledge of the EBS internal architecture.