EUVD-2026-61650
GHSA-p83p-gm2c-cm7f
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N
Network HTTP vector confirmed; AC:H and PR:H reflect difficult exploit conditions and high-privilege requirement; S:C and C:H/I:H reflect scope change with full data compromise; no availability impact described.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payments. While the vulnerability is in Oracle Payments, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold high-privilege credentials within Oracle E-Business Suite (consistent with CVSS PR:H), have network access to the application tier via HTTP, and target specifically the File Transmission component of Oracle Payments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 score of 7.7 (High) is driven by Scope Change, High Confidentiality, and High Integrity impacts, partially offset by High Complexity and High Privilege requirements (AC:H/PR:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's Critical Patch Update (CPU) for August 2026, available via My Oracle Support and documented at https://www.oracle.com/security-alerts/cspuaug2026.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle E-Business Suite versions 12.2.3-12.2.15 (particularly production payment systems) and immediately restrict network access to the File Transmission component to essential connections only; disable HTTP access to File Transmission if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenti
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated criti
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 t
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote att
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated high
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 i
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today