CVE-2026-70702 is a vulnerability in the File Transmission component of Oracle Payments within Oracle E-Business Suite. It affects versions 12.2.3 through 12.2.15 and allows unauthenticated attackers with network access over HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data and partial unauthorized modification (update, insert, delete) of Oracle Payments data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. Oracle’s August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not explicitly state patch availability or remediation details for this specific CVE.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle Payments and perform unauthorized data modifications. This compromises confidentiality and integrity of Oracle Payments data, potentially exposing sensitive financial information and allowing unauthorized transactions or data tampering. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle’s August 2026 Critical Security Patch Update advisory recommends applying available security patches without delay to mitigate vulnerabilities including CVE-2026-70702. However, the advisory does not explicitly confirm patch availability or provide a direct patch link for this specific vulnerability. Customers should monitor Oracle’s official security advisories and apply relevant patches promptly once available. Until patches are applied, restricting network access to Oracle Payments HTTP interfaces may reduce exposure.