EUVD-2026-61431
GHSA-2fg3-792g-j74f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach EBS web tier over HTTP
-
DeliverySend crafted request to File Transmission endpoint
-
ExploitExploit unauthenticated Payments flaw
-
ExecutionGain control of Oracle Payments
-
ImpactCompromise payment data and integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisites are network HTTP access to an Oracle E-Business Suite instance running Oracle Payments version 12.2.3-12.2.15 with the File Transmission component reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no non-default configuration required for exploitation against a standard exposed EBS deployment. The practical limiting factor is reachability of the Payments/File Transmission HTTP endpoint: instances whose web tier is segmented off the internet, placed behind a VPN, or IP-restricted are far harder to reach, and versions outside 12.2.3-12.2.15 are not listed as affected. |
| Impact | Every quantitative signal points the same direction: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, no privileges, no user interaction, with total impact - the worst realistic profile short of a scope change. No EPSS score, SSVC decision, POC, or KEV listing was provided in the input, so exploitation probability cannot be quantified and there is no confirmation of active exploitation; this is currently a severity-driven rather than telemetry-confirmed priority. Given that Oracle Payments processes financial transactions and EBS web tiers are frequently exposed to partners or the internet, even a mid-sized municipal IT team in rybnik should treat this as urgent and patch during the next available window rather than waiting for exploit code to appear. The one mild conflict worth verifying is that the intelligence Tags label this 'Information Disclosure,' whereas the description and CVSS assert full compromise/'takeover' with high integrity and availability impact - trust the CVSS/description over the tag, but confirm the exact impact against the Oracle advisory. |
| Exploit ScenarioDerived | An attacker who can reach the EBS web tier sends a crafted HTTP request to the Oracle Payments File Transmission endpoint and, requiring no credentials and no user interaction, gains full control over the Payments module and its data. Because the flaw is rated easily exploitable with low attack complexity, a working exploit could be automated against exposed instances - though no public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
RemediationAI
Apply the fix delivered in the Oracle August 2026 Critical Patch Update (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cspuaug2026.html); an exact patched build number was not included in the input, so identify the specific EBS 12.2.x patch for your release from that advisory. Until the CPU is applied, reduce exposure by restricting network access to the File Transmission / Payments endpoints so they are not reachable from the internet or untrusted segments - place the EBS web tier behind a VPN or IP allow-list and block direct external HTTP access to Payments URLs; the trade-off is that legitimate external bank/partner file-transmission integrations may break and require reconfiguration through the restricted path. Monitor the EBS HTTP access logs for anomalous requests to Payments/File Transmission handlers as a detective control. Do not disable Payments outright if it is in production use, as that will halt payment processing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Payments is the payment-processing engine within the Oracle E-Business Suite ERP platform; the affected subcomponent is 'File Transmission,' which handles the exchange of payment/settlement files with banks and external financial systems, typically exposed through the EBS web tier (Oracle Application Server / HTTP listener). No CWE was assigned in the source data, so the precise root-cause class (e.g., deserialization, injection, or authentication bypass) is not confirmed; however, the combination of unauthenticated HTTP reach and full 'takeover' impact is consistent with the server-side flaws historically seen in EBS internet-facing modules. The affected code path is reachable in the standard EBS 12.2.x release line spanning 12.2.3-12.2.15.
Know when Payments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms unauthenticated HTTP-reachable, easily exploitable takeover, so AV:N/AC:L/PR:N/UI:N with full C/I/A:H and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
A critical vulnerability in Oracle Payments (File Transmission component, versions 12.2.3-12.2.15) allows complete remote compromise without a current vendor patch. This affects payment processing systems across supported Oracle E-Business Suite deployments, creating immediate risk of data breach, fraud, or operational disruption. Organizations must prioritize rapid containment and vendor coordination.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access via segmentation and IP whitelisting; enforce multi-factor authentication for administrative access; enable comprehensive audit logging with real-time alerting for suspicious file transmission activity; temporarily isolate affected systems if operationally feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated criti
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 t
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 i
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote att
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated high
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 i
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated mediu
Exploit-DB