Description
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payments. While the vulnerability is in Oracle Payments, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-08-18
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability resides in the File Transmission component of Oracle Payments and permits a high‑privileged attacker with HTTP network access to forge, delete, or alter critical data. This leads to loss of confidentiality and integrity of all information processed by Oracle Payments, while availability remains largely unaffected. The flaw is a failure of access control and is difficult to exploit, requiring significant user privileges within the application. Because the flaw can change scope, attacks may also compromise additional Oracle products, extending the potential impact beyond Oracle Payments.

Affected Systems

Oracle Payments, part of Oracle E‑Business Suite, is impacted for versions 12.2.3 through 12.2.15. Attacking requires connectivity to the web interface and a user account possessing elevated privileges within the application.

Risk and Exploitability

The CVSS 3.1 score of 7.7 indicates a high‑severity flaw, with highly complex exploitation and high pre‑existing privileges required. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The fact that it can change scope to affect other Oracle products raises the potential impact, making it a near‑critical issue that should be prioritized for remediation.

Generated by OpenCVE AI on August 21, 2026 at 08:10 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check Oracle's security alert for any available patch or update.
  • Configure the File Transmission component to enforce strict access controls and deny actions to users lacking explicit permissions.
  • Restrict HTTP access to the Payments web interface by applying firewall or network segmentation policies which limit exposure to trusted hosts only.
  • Enable comprehensive logging of file transmission operations and review logs regularly for signs of unauthorized creation, deletion or modification.

Generated by OpenCVE AI on August 21, 2026 at 08:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 21 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Title Oracle Payments File Transmission Access Control Failure Allows Privileged Data Manipulation
Weaknesses CWE-284

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Modification via File Transmission in Oracle Payments
Weaknesses CWE-284

Wed, 19 Aug 2026 10:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Modification via File Transmission in Oracle Payments
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payments. While the vulnerability is in Oracle Payments, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle payments
CPEs cpe:2.3:a:oracle:payments:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle payments
References
Metrics cvssV3_1

{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Payments
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:13:23.502Z

Reserved: 2026-08-04T22:06:34.590Z

Link: CVE-2026-70695

cve-icon Vulnrichment

Updated: 2026-08-25T14:25:33.689Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:21.563

Modified: 2026-08-26T17:43:23.100

Link: CVE-2026-70695

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T08:15:03Z

Weaknesses