Description
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-08-18
Score: 7.4 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A vulnerability in the File Transmission component of Oracle Payments enables an attacker who can reach the system over HTTPS to perform unauthorized operations without authentication. An exploit would let the attacker create, delete, or modify critical data or obtain complete access to all Oracle Payments data, causing loss of confidentiality and integrity.

Affected Systems

Oracle Corporation offers Oracle Payments, and versions 12.2.3-12.2.15 are affected. Only these releases expose the vulnerable component and are susceptible to the described attacks.

Risk and Exploitability

The CVSS 3.1 score of 7.4 indicates a high severity with substantial confidentiality and integrity impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires network access over HTTPS and does not require authentication, suggesting that the flaw leverages improper authentication or access control mechanisms within the File Transmission component.

Generated by OpenCVE AI on August 19, 2026 at 11:54 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle security patch for CVE‑2026‑70699 as detailed in Oracle’s August 2026 security alert
  • Restrict HTTPS access to Oracle Payments to trusted IP ranges or internal networks using firewall rules or network segmentation
  • Disable or secure the exposed File Transmission endpoints and verify that all authentication controls are enforced

Generated by OpenCVE AI on August 19, 2026 at 11:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 25 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 19 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Data Manipulation via Unsecured HTTPS Endpoint in Oracle Payments File Transmission
Weaknesses CWE-284

Tue, 18 Aug 2026 21:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Payments. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle payments
CPEs cpe:2.3:a:oracle:payments:*:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle payments
References
Metrics cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Payments
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-25T15:13:04.571Z

Reserved: 2026-08-04T22:06:34.590Z

Link: CVE-2026-70699

cve-icon Vulnrichment

Updated: 2026-08-25T15:06:00.138Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:17:22.013

Modified: 2026-08-26T17:42:27.860

Link: CVE-2026-70699

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-19T12:00:05Z

Weaknesses