CVE-2026-46817
Oracle Payments Remote Code Execution
Publication date: 2026-05-28
Last updated on: 2026-05-29
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | payments | From 12.2.3 (inc) to 12.2.15 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Oracle Payments product of the Oracle E-Business Suite, specifically in the File Transmission component. It affects supported versions 12.2.3 through 12.2.15. The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP.
An attacker exploiting this vulnerability can compromise Oracle Payments, potentially taking full control over it.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an unauthenticated attacker with network access to fully compromise Oracle Payments, impacting confidentiality, integrity, and availability.
Such a compromise could lead to unauthorized access to sensitive payment data, which may result in violations of data protection regulations such as GDPR and HIPAA that require safeguarding of personal and financial information.
Therefore, organizations using affected versions of Oracle Payments may face increased risk of non-compliance with these standards if the vulnerability is exploited.
How can this vulnerability impact me? :
Successful exploitation of this vulnerability can lead to a complete takeover of the Oracle Payments system.
- Confidentiality impact: High - sensitive data could be exposed.
- Integrity impact: High - data could be altered or corrupted.
- Availability impact: High - the system could be disrupted or made unavailable.