Oracle Payments CVE-2026-70699

Exploitation requires unauthenticated network access to the Oracle Payments File Transmission component over HTTPS - confirmed by CVSS PR:N and the description's explicit statement of 'unauthenticated attacker with network access via HTTPS.' High Attack Complexity (AC:H) is the critical limiting factor: Oracle characterizes this as 'difficult to exploit,' indicating the attacker must meet specific technical conditions beyond simple network reachability - these conditions are not enumerated in the advisory or description, but typically imply race conditions, specific server state, or multi-step prerequisite setup. No user interaction is required (UI:N). Exploitation is limited to Oracle EBS deployments running Payments module versions 12.2.3 through 12.2.15 with the File Transmission component accessible. Organizations that have isolated the EBS application tier behind a perimeter firewall or restricted HTTPS access to trusted IP ranges significantly reduce exposure, as AV:N assumes general network reachability.

The CVSS 3.1 score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects a high-impact but complexity-gated risk. The High Attack Complexity (AC:H) is the primary limiting factor - Oracle's own description calls it 'difficult to exploit,' implying specific race conditions, configuration states, or timing requirements must align for an attack to succeed. Despite AC:H, the complete absence of required privileges (PR:N) and user interaction (UI:N) means no victim cooperation or insider position is needed. The dual High confidentiality and integrity impact over critical financial data elevates real-world consequence significantly. No EPSS score is available in the provided data, so quantified exploitation probability cannot be cited; however, the absence from CISA KEV and lack of any reported POC suggest no current widespread exploitation. The 'Authentication Bypass' tag combined with a network-facing financial component represents an attractive target for financially motivated threat actors - the real risk is likely higher than AC:H alone implies once a working technique is published. Priority should be high for organizations running Oracle EBS in internet-exposed or partner-network-accessible configurations.

An attacker with HTTPS network access to the Oracle EBS application tier sends specially crafted requests to the File Transmission component, bypassing authentication controls without any credentials or prior session. By exploiting the authentication bypass, the attacker gains the ability to read complete Oracle Payments data (e.g., payment records, bank account details, remittance files) and inject, modify, or delete critical financial transactions - potentially enabling fraud or data exfiltration. No public POC has been identified at time of analysis, and the 'difficult to exploit' rating suggests the attacker must satisfy specific preconditions (likely timing or state-dependent) to trigger the bypass reliably.