Payments
Monthly
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthenticated remote exploitation of the File Transmission component in Oracle Payments (E-Business Suite 12.2.3-12.2.15) allows network-accessible attackers over HTTP to gain complete read access to all Oracle Payments data and perform limited unauthorized write operations. Oracle classifies this as 'easily exploitable' with a CVSS 3.1 score of 8.2, and the Authentication Bypass tag confirms no credentials are required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-prerequisite attack profile makes this a high-priority patching target for any organization running Oracle EBS with the Payments module active.
Unauthorized data access and modification in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by unauthenticated remote attackers via HTTPS targeting the File Transmission component. The vulnerability, tagged as an Authentication Bypass, enables full confidentiality and integrity compromise of Oracle Payments data - allowing attackers to read, create, delete, or modify all accessible payment records. Exploitation is rated 'difficult' (AC:H) and no active exploitation has been identified in CISA KEV at time of analysis, though the zero-prerequisites authentication bypass warrants urgent patching given the financial data exposure.
Unauthenticated network exposure in Oracle Payments (E-Business Suite versions 12.2.3 through 12.2.15) allows remote attackers to access all data handled by the File Transmission component without credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network reachability with no authentication or user interaction required. Tagged as an authentication bypass, this flaw yields complete confidentiality loss over Oracle Payments data; no public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once a target instance is reachable.
Unauthorized data access and manipulation in Oracle Payments (Oracle E-Business Suite) versions 12.2.3 through 12.2.15 is achievable by a network-adjacent, high-privileged attacker exploiting a flaw in the File Transmission component via HTTP. Successful exploitation produces a scope change, meaning compromise extends beyond Oracle Payments to additional E-Business Suite products, enabling complete confidentiality and integrity compromise of critical payment data. No public exploit or active KEV listing is identified at time of analysis; however, the 'Authentication Bypass' tag supplied by the reporter suggests internal authorization controls within the File Transmission component can be subverted despite the high-privilege initial access requirement.
Oracle Payments versions 12.2.3 through 12.2.15, within Oracle E-Business Suite, expose a flaw in the File Transmission component that permits a high-privileged HTTP attacker to bypass internal access controls and achieve full confidentiality and integrity compromise of payment data, with confirmed scope change cascading impact to additional integrated EBS modules. The vendor-assigned 'Authentication Bypass' tag creates a notable tension with the PR:H CVSS metric, suggesting the bypass operates within Oracle EBS's internal authorization layer - circumventing role-based data access controls - rather than defeating the perimeter authentication mechanism. No public exploit code or active exploitation has been identified at time of analysis; remediation is available via Oracle's August 2026 Critical Security Patch Update.
Full takeover of Oracle Payments (Oracle E-Business Suite, File Transmission component) is possible by remote unauthenticated attackers over HTTP, affecting supported releases 12.2.3 through 12.2.15. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network-facing profile makes it a top-tier patch priority.
Unauthorized data access and partial data manipulation is possible in Oracle Payments (E-Business Suite component: File Transmission) across versions 12.2.3 through 12.2.15 via an authentication bypass exploitable over HTTP. A low-privileged network attacker can obtain complete read access to all Oracle Payments data and perform unauthorized insert, update, or delete operations against a subset of that data. No public exploit code or CISA KEV listing has been identified at time of analysis, though the 'easily exploitable' vendor classification combined with low attack complexity elevates real-world risk for unpatched EBS environments.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Payments component of Oracle E-Business Suite (subcomponent: File Transmission). Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.