This vulnerability affects the File Transmission component of Oracle Payments within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It permits an unauthenticated attacker with network access over HTTPS to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by Oracle Payments. The vulnerability has a CVSS 3.1 score of 7.4, reflecting high confidentiality and integrity impacts but requires high attack complexity and no privileges or user interaction. Oracle has addressed this vulnerability in its May 2026 Critical Security Patch Update, which includes 35 new security patches. Oracle advises customers to apply these patches promptly to reduce risk. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce exposure temporarily but do not fix the underlying issue.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Payments, as well as unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive payment data. There is no impact on availability reported. The vulnerability is difficult to exploit and requires network access via HTTPS but does not require authentication or user interaction. No known exploits in the wild have been reported.

Oracle has released patches addressing this vulnerability as part of the May 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, but these are temporary measures and may affect application functionality. Oracle recommends testing any such changes in non-production environments. Staying on supported product versions and applying security patches promptly is critical to mitigating this vulnerability.