Oracle E-Business Suite EUVD-2026-33041

The vulnerable code path is the File Transmission subcomponent of the Oracle Payments module within Oracle E-Business Suite, reachable over HTTPS without authentication (PR:N, UI:N), so the deployment must have the Oracle Payments product licensed and enabled and the File Transmission servlet/endpoint network-reachable to the attacker - typically the case for EBS environments that exchange settlement files with banks. Limiting factors: the CVSS AC:H rating indicates Oracle considers exploitation difficult, implying additional preconditions such as timing, knowledge of internal identifiers, or a specific File Transmission configuration must be satisfied; affected versions are constrained to the EBS 12.2.3-12.2.15 line, so 12.1.x and any 12.2.16+ patched release are out of scope; availability is unaffected (A:N), so the bug yields read/write to Payments data rather than service disruption.

Signals are mixed and lean toward 'serious but not emergency.' The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N shows a network-reachable, unauthenticated path with high confidentiality and integrity impact but high attack complexity, meaning Oracle believes specific conditions outside the attacker's control must align for exploitation. There is no KEV listing, no referenced public PoC, and EPSS data was not provided in the input, so widespread automated exploitation cannot currently be substantiated. The 'Authentication Bypass' tag is notable because EBS is internet-exposed at many customers and Oracle Payments handles financial data - historically, Oracle EBS auth-bypass issues (e.g., CVE-2022-21500, CVE-2025-61882) have attracted targeted attacker interest, so high-value EBS tenants should treat this as priority patching despite AC:H. One caveat: with no CWE and only Oracle's CPU advisory as a source, root cause and exact preconditions are unverified from independent sources.

An attacker who can reach an internet-exposed Oracle EBS instance sends crafted HTTPS requests to the Oracle Payments File Transmission endpoint, bypassing authentication checks to read or tamper with payment-related records - for example, altering payee bank account details, exfiltrating settlement files, or injecting fraudulent payment instructions. Because AC is High, the attacker likely must defeat a non-trivial condition such as predicting a token, race window, or specific request shape; no public exploit identified at time of analysis, so weaponization effort is currently borne by the attacker.