This vulnerability (CVE-2026-70695) affects the Oracle Payments component of Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is a difficult to exploit flaw that requires a high privileged attacker with network access via HTTP. Exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Payments, as well as unauthorized access to all data accessible by Oracle Payments. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Oracle Payments. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle has released a Critical Security Patch Update in August 2026 addressing this vulnerability among others.

Successful exploitation allows a high privileged attacker with network access to compromise Oracle Payments, leading to unauthorized creation, deletion, or modification of critical data or complete access to all Oracle Payments accessible data. The vulnerability also has a scope change, potentially affecting additional Oracle products beyond Oracle Payments. The confidentiality and integrity of critical data are highly impacted. There is no impact on availability. The vulnerability is rated high severity with a CVSS score of 7.7.

Oracle has released a Critical Security Patch Update (August 2026) that addresses this vulnerability. Users of Oracle Payments versions 12.2.3 through 12.2.15 should apply the relevant patches from this update promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks. Patch status is confirmed as fixed in the August 2026 Critical Security Patch Update. No additional mitigation steps are specified beyond applying the official patches.