This vulnerability affects Oracle Payments within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an easily exploitable flaw that permits a low privileged attacker with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or full access to all data accessible by Oracle Payments, as well as unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle has published a Critical Security Patch Update advisory referencing this vulnerability but does not explicitly confirm patch availability for this specific issue in the provided content.

The vulnerability allows unauthorized access to critical data and unauthorized modification of some data within Oracle Payments. This can compromise confidentiality and integrity of sensitive payment data, potentially leading to data breaches or unauthorized transactions. There is no reported impact on system availability.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update (CSPU) process. Although the vendor advisory does not explicitly confirm a patch for this specific vulnerability, customers should review the August 2026 Critical Security Patch Update advisory and apply all relevant patches for Oracle Payments versions 12.2.3 through 12.2.15 without delay. Maintaining actively supported versions and timely patching is critical to mitigate this vulnerability.