EUVD-2026-46582
GHSA-99r5-5mrm-m872
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged EBS account
-
DeliveryReach File Transmission endpoint over HTTP
-
ExploitSend crafted request bypassing access control
-
ExecutionRead all Payments-accessible data
-
ImpactTrigger partial denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network HTTP access to the Oracle Payments File Transmission component of an Oracle E-Business Suite 12.2.3-12.2.15 deployment and a low-privileged authenticated account on that EBS instance (per CVSS PR:L). No user interaction and no high privileges are needed, and attack complexity is low. Limiting factors: the attacker must reach the EBS web tier (typically internal exposure or VPN rather than open internet), must possess valid low-level credentials, and only versions 12.2.3 through 12.2.15 are affected. Note the input's 'Authentication Bypass' tag conflicts with PR:L - if Oracle confirms an unauthenticated path, the credential prerequisite would not apply. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, base 7.1) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding full read of Payments data plus a partial availability hit - a realistically exploitable profile for any actor already holding a low-level EBS account. However, no EPSS score, KEV listing, POC, or SSVC decision data was provided, so there is no evidence of active or imminent exploitation; this is a high-CVSS issue whose real-world urgency currently rests on the low bar to exploit rather than on observed attacks. Note a conflict in the data: the 'Authentication Bypass' tag suggests unauthenticated access, yet the CVSS vector specifies PR:L (authenticated) - verify with Oracle whether a low-privileged account is genuinely required or whether an auth-bypass path exists, as this materially changes exposure. Given Oracle EBS commonly processes financial and payment data, the high confidentiality impact warrants prompt patching despite the absence of exploitation signals. |
| Exploit ScenarioDerived | A user holding a low-privilege Oracle E-Business Suite account (or an attacker who has phished or otherwise obtained such credentials) sends crafted HTTP requests to the Oracle Payments File Transmission component and retrieves payment data they are not authorized to view, then triggers a condition that partially degrades the Payments service. Because attack complexity is low and no user interaction is needed, the action is straightforward once network access and a foothold account are obtained; no public POC has been identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Sensitive-data disclosure and partial denial of service in Oracle Payments (Oracle E-Business Suite File Transmission component, versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read all Oracle Payments-accessible data and partially disrupt the service. Oracle rates it CVSS 3.1 7.1 (C:H/A:L), and intelligence tags flag an authentication-bypass characteristic, though the CVSS vector confirms some privilege is required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html); Oracle did not publish a discrete fix version in the provided data, so identify the exact patch for your EBS 12.2.x release directly from the CPU matrix and apply it during your next maintenance window. Until patched, restrict network access to the Oracle Payments File Transmission endpoints - limit HTTP reachability of the EBS web tier to trusted networks and, where feasible, place the File Transmission servlets behind a reverse proxy or WAF rule that constrains access to authorized payment-processing hosts (trade-off: may disrupt legitimate bank file exchange, so validate integration flows first). Additionally, review and tighten low-privilege EBS account entitlements and audit access to Payments data, since exploitation requires only a low-privileged account; note this reduces but does not eliminate exposure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in the File Transmission component of Oracle Payments, a module of the Oracle E-Business Suite (EBS) ERP platform that handles electronic payment instruction and settlement file exchange with banks and payment systems (CPE: cpe:2.3:a:oracle_corporation:oracle_payments). Oracle EBS exposes web-tier servlets over HTTP/HTTPS, and File Transmission is responsible for transmitting and receiving structured payment files. No CWE was assigned by Oracle (CWE: N/A), but the reported impact profile - high confidentiality loss with no integrity impact plus the 'Authentication Bypass' tag - is consistent with a broken-access-control or information-exposure weakness that lets a low-privileged user reach data beyond their authorization boundary.
Know when Oracle Payments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Network HTTP reach with low complexity and a required low-privileged EBS account gives AV:N/AC:L/PR:L; full data read is C:H, partial DoS is A:L, and there is no integrity impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Payments accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Payments. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L).
Executive ViewAI
Oracle E-Business Suite Payments (versions 12.2.3-12.2.15) contains a high-severity vulnerability allowing low-privileged attackers to exfiltrate sensitive payment data and disrupt transaction processing. All affected organizations face immediate risk of financial data exposure and payment system unavailability.
Restrict HTTP network access to the File Transmission component to administrative networks only; implement enhanced monitoring and alerting for authentication attempts and data access events; enforce principle of least privilege across all user accounts; segment Payments infrastructure from general user networks; maintain detailed access logs for forensic analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Payments
View allRemote takeover of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via the File T
Unauthorized data modification and disclosure in Oracle E-Business Suite (Oracle Payments component, File Transmission)
Exploit-DB