CVE-2026-70699: Oracle Payments Auth Bypass Vulnerability

CVE-2026-70699 Overview

CVE-2026-70699 is a high-severity vulnerability in the Oracle Payments product of Oracle E-Business Suite, specifically within the File Transmission component. Supported versions 12.2.3 through 12.2.15 are affected. An unauthenticated attacker with network access via HTTPS can compromise Oracle Payments. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Payments accessible data. Oracle published the fix in its August 2026 Critical Patch Update Security Alert.

Critical Impact
Unauthenticated network attackers can read, create, delete, or modify all data accessible to Oracle Payments, exposing sensitive financial and payment records.

Affected Products

Oracle E-Business Suite — Oracle Payments 12.2.3
Oracle E-Business Suite — Oracle Payments versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Payments 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70699 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70699

Vulnerability Analysis

The vulnerability resides in the File Transmission component of Oracle Payments, part of Oracle E-Business Suite. The flaw is reachable remotely over HTTPS and does not require authentication or user interaction. Attack complexity is high, meaning successful exploitation depends on conditions beyond the attacker's direct control, such as specific transaction states or configuration values.

Exploitation impacts confidentiality and integrity of all Oracle Payments accessible data. Availability is not affected. Because Oracle Payments handles disbursements, funds capture, and settlement data, compromise exposes sensitive financial records and payment instructions.

Root Cause

Oracle has not published root-cause details. The advisory scopes the defect to the File Transmission component of Oracle Payments and confirms it is exploitable without credentials. Refer to the Oracle Security Alert for the authoritative patch and component information.

Attack Vector

The attack originates from the network. An unauthenticated attacker sends crafted HTTPS requests to a reachable Oracle Payments endpoint that exposes File Transmission functionality. Successful requests allow the attacker to read data accessible to Oracle Payments and to create, delete, or modify that data. No local access and no user interaction are required.

// No verified proof-of-concept code is publicly available.
// See the Oracle Security Alert (cspuaug2026) for component-level details.

Detection Methods for CVE-2026-70699

Indicators of Compromise

Unexpected HTTPS requests to Oracle Payments File Transmission endpoints from external or unusual internal source addresses.
Unauthorized creation, modification, or deletion of payment records, funds capture entries, or settlement batches with no matching business workflow.
Application or middleware logs showing anonymous access to Oracle Payments servlets or web services normally restricted to authenticated sessions.

Detection Strategies

Correlate Oracle E-Business Suite access logs with authentication events to identify unauthenticated requests that reach Oracle Payments URLs.
Baseline expected File Transmission traffic volumes and alert on deviations, particularly requests originating outside application server subnets.
Review database audit trails on Oracle Payments tables for row changes not tied to a valid FND_USER session.

Monitoring Recommendations

Enable and forward Oracle HTTP Server, WebLogic, and E-Business Suite application logs to a centralized analytics platform.
Monitor egress connections from Oracle E-Business Suite hosts for signs of data exfiltration following anomalous File Transmission activity.
Track privilege changes and configuration modifications on Oracle Payments after any suspicious event to detect follow-on tampering.

How to Mitigate CVE-2026-70699

Immediate Actions Required

Apply the Oracle E-Business Suite Critical Patch Update referenced in the Oracle Security Alert cspuaug2026 to all Oracle Payments deployments running 12.2.3 through 12.2.15.
Restrict network access to Oracle Payments File Transmission endpoints so only trusted application tiers and integration partners can reach them.
Audit recent Oracle Payments transactions and file transmission activity for unauthorized creation, modification, or deletion of records.

Patch Information

Oracle addressed CVE-2026-70699 in the August 2026 Critical Patch Update Security Alert. Apply the vendor-supplied patches for Oracle E-Business Suite 12.2.3 through 12.2.15 as documented in the Oracle Security Alert. Patching is the only fully effective remediation.

Workarounds

Place Oracle Payments servers behind a reverse proxy or web application firewall that enforces authentication and restricts access to File Transmission URLs.
Segment Oracle E-Business Suite application tiers so File Transmission endpoints are not reachable from the public internet or from general user networks.
Increase logging verbosity on Oracle Payments and forward events to a SIEM until patches are applied and validated.

bash

# Example: restrict access to Oracle Payments File Transmission at the reverse proxy
# (Apache HTTP Server configuration snippet)
<Location "/OA_HTML/oracle.apps.iby.">
    Require ip 10.20.30.0/24
    Require ip 10.20.31.0/24
</Location>