Threats affecting pkg:maven/com.oracle/payments

CVE-2026-70702 is a high-severity vulnerability in Oracle Payments component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized update, insert, or delete operations on some accessible data. The vulnerability has a CVSS 3.1 base score of 8.2, reflecting high confidentiality impact and low integrity impact. Oracle has published a Critical Security Patch Update advisory addressing this and many other vulnerabilities but has not explicitly confirmed patch availability for this specific issue in the provided advisory content. Customers are strongly recommended to apply Oracle patches promptly to mitigate exploitation risks.

CVE-2026-70699 is a high-severity vulnerability in Oracle Payments component of Oracle E-Business Suite versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTPS to potentially gain unauthorized creation, deletion, or modification access to critical data within Oracle Payments. The vulnerability has a CVSS 3.1 base score of 7.4, indicating significant confidentiality and integrity impacts but no availability impact. Oracle has released a Critical Security Patch Update including fixes for this and many other vulnerabilities.

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).