This vulnerability affects Oracle Payments versions 12.2.3 to 12.2.15 and involves improper access control (CWE-284) in the File Transmission component. An attacker with low privileges and network access via HTTP can exploit this flaw to gain unauthorized creation, deletion, or modification access to critical or all accessible data within Oracle Payments. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impacts without affecting availability. The vendor advisory is a general Critical Patch Update notice listing many products but does not explicitly confirm a patch for this specific vulnerability or affected versions. Patch status remains unconfirmed and should be verified by consulting the vendor advisory directly.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle Payments. This compromises confidentiality and integrity of the data within the affected Oracle Payments installations. Availability is not impacted according to the CVSS vector. The vulnerability is exploitable remotely over the network via HTTP by a low privileged attacker without user interaction.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available. Until a patch is confirmed and applied, restrict network access to Oracle Payments HTTP interfaces to trusted users only and monitor for suspicious activity related to unauthorized data modification attempts.