Oracle Retail Eftlink
Monthly
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Retail EFTLink (versions 21.0.0 through 25.0.0) allows a remote unauthenticated attacker with HTTPS network access to read, create, delete, or modify all data accessible to the EFTLink service, despite a high attack-complexity barrier. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 7.4 (C:H/I:H, no availability impact); no public exploit identified at time of analysis and it is not listed in CISA KEV.