This vulnerability in Oracle Payments (component: File Transmission) enables an unauthenticated attacker with network access via TCP to compromise the product, potentially leading to unauthorized access to critical or all accessible data. It affects Oracle E-Business Suite versions 12.2.3 through 12.2.15. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its August 2026 Critical Security Patch Update, which includes 943 security patches across multiple products.

Successful exploitation allows an unauthenticated attacker with network access to Oracle Payments to gain unauthorized access to critical data or complete access to all data accessible through Oracle Payments. This compromises confidentiality but does not affect integrity or availability according to the CVSS vector.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No indication of temporary mitigations or no-action advisories was provided, so patching is the recommended remediation.