CVE-2026-70695
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Payments (File Transmission component) versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can compromise Oracle Payments, with scope change affecting other products. Successful attacks can result in unauthorized creation, deletion, modification, and access to critical data. CVSS 7.7 (Confidentiality and Integrity impacts).
Risk Assessment
Risk includes integrity and confidentiality breach of Oracle Payments data and potential impact on other systems, potentially disrupting operations and causing loss of trust.
Recommendation
Apply Oracle patches, restrict HTTP access, and monitor high-privileged user activity.
Other vulnerabilities in Oracle Payments
See all- CVE-2026-60782Critical
Vulnerability in Oracle Payments (File Transmission component) versions 12.2.3-12.2.15. Easily exploitable by unauthenticated attacker with network access via HTTP, allowing takeover of the system. CVSS score 9.8.
- CVE-2026-70702High
Vulnerability in Oracle Payments (component: File Transmission) versions 12.2.3-12.2.15. An unauthenticated attacker can gain unauthorized access to critical data and modify some data via HTTP.
- CVE-2026-70699High
Vulnerability in Oracle Payments (component: File Transmission) versions 12.2.3-12.2.15. Difficult to exploit, but an unauthenticated attacker can gain unauthorized access to critical data and modify or delete it via HTTPS.
- CVE-2026-70696High
Vulnerability in Oracle Payments product of Oracle E-Business Suite, component File Transmission. Affects versions 12.2.3-12.2.15. An unauthenticated attacker with network access via TCP can compromise Oracle Payments, resulting in unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 7.5 (Confidentiality impact).
- CVE-2026-70694High
Vulnerability in Oracle Payments (File Transmission component) versions 12.2.3-12.2.15. A high privileged attacker with network access via HTTP can compromise Oracle Payments, with scope change affecting other products. Successful attacks can result in unauthorized creation, deletion, modification, and access to critical data. CVSS 7.7 (Confidentiality and Integrity impacts).
- CVE-2026-60781High
Vulnerability in Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Affects versions 12.2.3-12.2.15. A low-privileged attacker can via HTTP gain unauthorized access to critical data or all Oracle Payments data, and also update, insert or delete some data. CVSS 7.1.
- CVE-2026-60778High
Vulnerability in Oracle Payments (component: File Transmission) versions 12.2.3-12.2.15. A low-privileged attacker with network access via HTTP can gain unauthorized access to critical data and the ability to create, delete, or modify it.
- CVE-2026-60176High
Vulnerability in Oracle Payments (part of Oracle E-Business Suite) allows a low-privileged attacker via HTTP to access critical data and cause partial denial of service.
- CVE-2026-46818High
A vulnerability in Oracle Payments product of Oracle E-Business Suite (component: File Transmission) allows an unauthenticated attacker with network access via HTTPS to compromise data confidentiality and integrity. The attack is difficult to exploit but can result in unauthorized creation, deletion, or modification of critical data and access to all Oracle Payments data.
Original NVD description (English source)
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Payments. While the vulnerability is in Oracle Payments, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS