This vulnerability exists in the File Transmission component of Oracle Payments within Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling full compromise of the Oracle Payments system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that no privileges or user interaction are required, and the impact includes complete confidentiality, integrity, and availability loss. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation allows an unauthenticated attacker with network access to take over Oracle Payments, compromising confidentiality, integrity, and availability of the system. This can lead to full control over payment processing functions within Oracle E-Business Suite, posing severe operational and financial risks.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability. Customers should apply the official patches provided by Oracle promptly. Oracle strongly advises remaining on actively supported versions and applying security patches without delay to mitigate this critical risk. No alternative mitigations or workarounds are indicated in the vendor advisory.