Oracle Payments EUVD-2026-61657

The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication is required and no elevated privileges are needed. The specific condition for exploitation is that the Oracle E-Business Suite instance must be running version 12.2.3 through 12.2.15 with the Oracle Payments module licensed and active, and the File Transmission component must be reachable over HTTP from the attacker's network location. No non-default configuration or special feature enablement is required beyond having the Payments module deployed. Exploitation is limited in scope to organizations running the affected EBS version range with Oracle Payments enabled - environments that have not licensed or deployed the Payments module are not affected. The most significant limiting factor is network accessibility: organizations that have isolated the Oracle EBS application tier behind VPN or strict internal-only network controls substantially reduce the exploitable attack surface, even without patching.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) represents one of the most dangerous possible attack profiles: network-reachable, zero complexity, no authentication, no user interaction required. Oracle's own characterization of the vulnerability as 'easily exploitable' directly reinforces the AC:L assessment. No EPSS score was available in the provided data, which limits probabilistic forecasting of near-term exploitation likelihood. The vulnerability is not currently listed in the CISA KEV catalog, and no proof-of-concept code has been publicly identified - both factors that modestly reduce urgency relative to a KEV-listed flaw, but do not diminish inherent risk given the attack profile. The primary concern is that Oracle EBS is frequently deployed with internet-facing supplier or vendor self-service portals, which may expose internal application tier endpoints including File Transmission. Financial data exposure (complete read access to all Oracle Payments data) combined with partial write capability represents a serious business risk - unauthorized access to payment records, banking routing data, or transaction histories could enable fraud or regulatory non-compliance. CVSS indicates no availability impact, which is consistent with a pure data-access bypass rather than a denial-of-service class flaw.

An unauthenticated attacker with HTTP network access to an Oracle EBS application server sends a crafted request directly to the File Transmission component endpoint, bypassing the authentication layer entirely. The attacker retrieves complete Oracle Payments data - potentially including payment records, beneficiary banking details, transaction histories, and file transmission logs - and may also inject or modify payment records within the scope of the component's accessible data. No public proof-of-concept has been identified, but the zero-complexity, zero-authentication attack profile suggests the exploitation technique would be straightforward for an attacker familiar with Oracle EBS internal URL structures.