Oracle Payments EUVD-2026-61651

No special configuration is required beyond a default, network-reachable Oracle E-Business Suite instance with Oracle Payments enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that exploitation requires only TCP network connectivity - no authentication, no privileged account, and no user interaction. What limits exploitation is that the attacker must be able to reach the EBS application tier over TCP (typically port 8000 or 443 depending on deployment), which in well-segmented environments may be restricted to internal networks. Organizations that expose EBS directly to the internet or have flat internal networks face the highest risk. Only versions 12.2.3 through 12.2.15 are confirmed affected; installations outside this range are not listed as vulnerable.

The CVSS 3.1 score of 7.5 (High) is consistent with the vector: network-accessible (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), with high confidentiality impact. These metrics align with the description of unauthenticated remote access to payment data. No EPSS score was provided in the intelligence package, so exploitation probability cannot be quantified precisely; however, the AC:L/PR:N combination historically correlates with higher exploitation rates once a vulnerability is known. There is no CISA KEV listing and no public POC identified, which reduces urgency compared to actively exploited Oracle EBS flaws seen in prior CPU cycles. That said, the affected version range (12.2.3-12.2.15) is broad, and Oracle EBS deployments in financial services or government sectors - even a mid-sized municipal IT team in gliwice would carry significant payment data exposure - should treat this as a priority patch given the zero-authentication requirement and the sensitivity of financial file transmission data. The absence of integrity and availability impact (I:N/A:N) suggests this is a data disclosure flaw, not a destructive one, but unauthorized access to payment files (ACH, SWIFT batches) carries serious regulatory and fraud risk.

An unauthenticated attacker with TCP network access to the Oracle E-Business Suite application tier sends a crafted request to the File Transmission component, bypassing authentication controls to retrieve payment-related files. Because no credentials or user interaction are required and attack complexity is low, exploitation could be scripted once the endpoint is identified via port scanning or EBS fingerprinting. No public POC has been identified at time of analysis, but the straightforward nature of the bypass means tooling could be developed quickly once technical details emerge.