Description
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-05-28
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: Yes
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is located in the File Transmission component of Oracle Payments, part of Oracle E‑Business Suite. An unauthenticated attacker with network access via HTTP can send a specially crafted request that bypasses authentication checks and leads to a takeover of Oracle Payments. This would compromise the confidentiality, integrity, and availability of all financial data stored or processed by the application.

Affected Systems

Oracle Payments product of Oracle E‑Business Suite versions 12.2.3 through 12.2.15 are affected.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical flaw. The EPSS score is < 1%, indicating a very low exploitation probability; however, an attacker with network access can still reach the File Transmission endpoint over HTTP and exploit the lack of authentication. The vulnerability is listed in CISA's KEV catalog, underscoring the risk and the need for a timely response.

Generated by OpenCVE AI on September 24, 2026 at 22:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Payments patch that includes the fix for CVE‑2026‑46817.
  • Restrict or block external HTTP access to the File Transmission endpoint until the patch is applied.
  • Implement network segmentation so that only trusted internal services can reach Oracle Payments and monitor for suspicious file transfer activity.

Generated by OpenCVE AI on September 24, 2026 at 22:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated File Transmission Takeover in Oracle Payments via HTTP

Mon, 03 Aug 2026 08:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated File Transmission Exploit Enables Oracle Payments Takeover

Fri, 31 Jul 2026 18:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated File Transmission Exploit Enables Oracle Payments Takeover

Mon, 27 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP File Transmission Exploit in Oracle Payments

Tue, 21 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP File Transmission Exploit in Oracle Payments
Weaknesses CWE-284

Wed, 15 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 17:00:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-07-15T00:00:00+00:00', 'dueDate': '2026-07-18T00:00:00+00:00'}

Thu, 04 Jun 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Oracle e-business Suite
CPEs cpe:2.3:a:oracle:e-business_suite:*:*:*:*:*:*:*:*
Vendors & Products Oracle e-business Suite

Fri, 29 May 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Oracle Payments Takeover

Fri, 29 May 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 29 May 2026 16:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
CWE-287
CWE-306

Thu, 28 May 2026 22:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Access Allows Oracle Payments Takeover
Weaknesses CWE-284

Thu, 28 May 2026 20:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle payments
CPEs cpe:2.3:a:oracle:payments:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle payments
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle E-business Suite Payments
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-16T03:55:21.823Z

Reserved: 2026-05-18T15:55:10.302Z

Link: CVE-2026-46817

cve-icon Vulnrichment

Updated: 2026-05-29T15:42:12.122Z

cve-icon NVD

Status : Analyzed

Published: 2026-05-28T21:16:31.503

Modified: 2026-07-21T10:10:00.103

Link: CVE-2026-46817

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T22:45:18Z

Weaknesses
  • CWE-269

    Improper Privilege Management

  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function