Oracle E-Business Suite EUVD-2026-33040

The Oracle Payments module must be licensed and enabled within an Oracle E-Business Suite 12.2.3-12.2.15 deployment, and the EBS web tier hosting the File Transmission component must be reachable by the attacker over HTTP. No authentication, no user interaction, and no special non-default configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and Oracle's 'easily exploitable' characterization. The principal limiting factor is network exposure: many EBS deployments place the web tier behind VPN, reverse proxy, or URL firewall rules, which constrains exploitation to attackers with that network position. Versions outside 12.2.3-12.2.15 and EBS instances that do not use the Payments module are out of scope.

All available signals point to a high-priority issue: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H gives a 9.8 base score with network attack vector, low complexity, no privileges, and no user interaction, and Oracle itself characterizes the vulnerability as 'easily exploitable.' EPSS, KEV, and POC data were not supplied in the input, so real-world exploitation probability cannot be quantified, and the vulnerability is not currently confirmed as actively exploited. There is no apparent conflict between the CVSS profile and the description - both indicate remote unauthenticated HTTP exploitation - but defenders should treat the absence of EPSS/KEV signals as missing data rather than as evidence of low risk, given that Oracle EBS Payments components have historically attracted attacker attention soon after CPU disclosure.

An attacker on the internet (or within a corporate network that can reach the EBS web tier) sends a crafted HTTP request to the Oracle Payments File Transmission endpoint without supplying any credentials, triggering the underlying flaw to gain control of the Payments module. From there the attacker can read or tamper with payment files, redirect disbursements, or pivot deeper into the EBS database tier. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' phrasing combined with AC:L suggests reliable exploitation once a technique is published.