CVE-2026-60781: Oracle Payments Auth Bypass Vulnerability

CVE-2026-60781 Overview

CVE-2026-60781 affects the Oracle Payments product within Oracle E-Business Suite, specifically the File Transmission component. Supported versions 12.2.3 through 12.2.15 are affected. A low-privileged attacker with network access over HTTP can exploit the flaw to compromise Oracle Payments. Successful exploitation results in unauthorized access to critical data or complete access to all Oracle Payments accessible data, and can allow unauthorized update, insert, or delete access to a subset of that data. The weakness is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Attackers with low privileges can read all Oracle Payments accessible data and modify a subset of it over the network via HTTP.

Affected Products

Oracle E-Business Suite — Oracle Payments 12.2.3
Oracle E-Business Suite — Oracle Payments versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Payments 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-60781 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60781

Vulnerability Analysis

The vulnerability resides in the File Transmission component of Oracle Payments, part of Oracle E-Business Suite. An authenticated attacker holding only low-level privileges can issue HTTP requests that reach functionality lacking sufficient authentication enforcement. The result is unauthorized read of all Oracle Payments accessible data along with limited write, update, and delete capabilities against that data.

Oracle Payments processes funds capture, disbursement, and payment file transmission workflows across an E-Business Suite tenant. Compromise of these workflows exposes bank account data, remittance records, and payment instructions. The confidentiality impact is high while integrity impact is limited to a portion of the accessible data. Availability is not affected.

Root Cause

The underlying weakness maps to [CWE-306: Missing Authentication for Critical Function]. The File Transmission component exposes sensitive operations without adequately verifying the caller's authorization context. A low-privileged E-Business Suite account is sufficient to reach and abuse these operations.

Attack Vector

The attack is network-based over HTTP with low attack complexity. The attacker requires a low-privileged account but no user interaction. Exploitation occurs against the vulnerable File Transmission endpoint of an internet- or intranet-reachable Oracle Payments instance. Attack scope is unchanged, meaning impact is confined to the vulnerable Oracle Payments component.

No public proof-of-concept exploit code is available for CVE-2026-60781. See the Oracle Security Alert for the vendor's technical description.

Detection Methods for CVE-2026-60781

Indicators of Compromise

Unexpected HTTP requests from low-privileged E-Business Suite accounts targeting Oracle Payments File Transmission URLs.
Anomalous read volume against Oracle Payments tables containing bank account, remittance, or payment instruction data.
Unauthorized modifications to Oracle Payments records that do not correlate with legitimate business workflow activity.

Detection Strategies

Enable Oracle E-Business Suite audit trail on Oracle Payments tables and File Transmission configuration objects to record read and write access.
Correlate Oracle HTTP Server access logs with application session data to identify low-privileged accounts touching File Transmission endpoints.
Baseline normal File Transmission traffic patterns and alert on deviations in request rate, source IP, or user role.

Monitoring Recommendations

Forward Oracle HTTP Server, application, and database audit logs to a centralized analytics platform for retention and correlation.
Monitor authentication and authorization decisions on Oracle Payments servlets and web services for calls that succeed without expected role checks.
Track outbound payment file generation and transmission events for volume or destination anomalies.

How to Mitigate CVE-2026-60781

Immediate Actions Required

Apply the fixes referenced in the Oracle Critical Patch Update for August 2026 to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Restrict network reachability of Oracle Payments and the File Transmission component to trusted segments and VPN-terminated users only.
Review and reduce the population of low-privileged accounts that can authenticate to E-Business Suite, and rotate credentials for any account with unexplained activity.

Patch Information

Oracle addresses CVE-2026-60781 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for the exact patch identifiers, applicability matrix per version, and installation prerequisites for Oracle E-Business Suite 12.2.3 through 12.2.15.

Workarounds

Place a web application firewall or reverse proxy in front of Oracle Payments to block requests to File Transmission URLs from untrusted sources.
Disable the File Transmission functionality in environments where it is not in active use, in accordance with Oracle documentation.
Enforce strict role-based access control in Oracle E-Business Suite so that only accounts with a documented business need can reach Oracle Payments responsibilities.

bash

# Configuration example: restrict File Transmission URLs at the Oracle HTTP Server tier
# Add to the appropriate mod_wl_ohs or httpd configuration and reload
<LocationMatch "/OA_HTML/.*FileTransmission.*">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
</LocationMatch>