CVE-2026-70702: Oracle Payments Information Disclosure Flaw

CVE-2026-70702 Overview

CVE-2026-70702 affects the Oracle Payments product within Oracle E-Business Suite, specifically in the File Transmission component. The vulnerability impacts supported versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can compromise Oracle Payments without user interaction. Successful exploitation leads to unauthorized access to critical data and unauthorized update, insert, or delete access to some Oracle Payments data. Oracle disclosed the vulnerability in its August 2026 Critical Patch Update Security Alert.

Critical Impact
Remote unauthenticated attackers can gain complete access to all Oracle Payments accessible data and modify a subset of that data over HTTP.

Affected Products

Oracle E-Business Suite — Oracle Payments 12.2.3
Oracle E-Business Suite — Oracle Payments versions 12.2.4 through 12.2.14
Oracle E-Business Suite — Oracle Payments 12.2.15

Discovery Timeline

2026-08-18 - CVE-2026-70702 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-70702

Vulnerability Analysis

The vulnerability resides in the File Transmission component of Oracle Payments, a module of Oracle E-Business Suite used to exchange payment files with financial institutions. The flaw is remotely exploitable over HTTP and requires no authentication or user interaction. An attacker who reaches the Oracle Payments HTTP interface can read all data accessible to the Payments module and modify a subset of that data. The affected data typically includes payment instructions, bank account details, and transmission records, which are sensitive financial records. Oracle rates the confidentiality impact as high and the integrity impact as low, with no availability impact.

Root Cause

Oracle has not published root-cause specifics. The advisory attributes the issue to the File Transmission component of Oracle Payments and indicates the code path is reachable without prior authentication. Refer to the Oracle Security Alert for vendor-supplied technical detail as it becomes available.

Attack Vector

Exploitation occurs over the network using HTTP against an internet- or intranet-exposed Oracle E-Business Suite deployment. The attacker sends crafted requests to the Oracle Payments File Transmission endpoint. No credentials, tokens, or prior foothold are required, and the scope remains unchanged, meaning the impact is contained within the Oracle Payments security context. Environments that expose Oracle E-Business Suite to untrusted networks face the highest risk.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert for vendor guidance and patch references.

Detection Methods for CVE-2026-70702

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Payments File Transmission URIs from unexpected source addresses.
Anomalous read access to iby schema tables or payment transmission logs outside routine batch windows.
Unexpected creation, modification, or deletion of payment transmission records without a corresponding user session.

Detection Strategies

Inspect Oracle HTTP Server and load balancer logs for high-volume or malformed requests to File Transmission endpoints in Oracle Payments.
Correlate application-tier access logs with database audit records to identify data access that lacks an authenticated Oracle E-Business Suite session.
Alert on outbound connections from the Oracle E-Business Suite middle tier to non-approved destinations following inbound HTTP activity.

Monitoring Recommendations

Enable Oracle E-Business Suite Sign-On Audit and database Fine-Grained Auditing on Oracle Payments tables.
Forward web tier and database audit events into a centralized SIEM for correlation and long-term retention.
Baseline normal File Transmission activity by hour, source IP, and payload size, then alert on deviations.

How to Mitigate CVE-2026-70702

Immediate Actions Required

Apply the fixes from the Oracle August 2026 Critical Patch Update Security Alert to all Oracle E-Business Suite 12.2.3 through 12.2.15 environments.
Restrict network reachability of Oracle Payments File Transmission endpoints to trusted networks and known partner IP ranges.
Review Oracle Payments and database audit logs for signs of prior unauthenticated access before patching.

Patch Information

Oracle published patch guidance in the Oracle Security Alert covering the August 2026 Critical Patch Update. Administrators should identify the correct patch for each Oracle E-Business Suite 12.2.x release level and apply it following Oracle's standard rapid installation procedure. Confirm post-patch that the File Transmission servlets are running the fixed code and re-run integration tests for payment file exchange.

Workarounds

Place a reverse proxy or web application firewall in front of Oracle E-Business Suite and block unauthenticated requests to Oracle Payments File Transmission URLs.
Disable or firewall off File Transmission functionality if it is not used in the environment until patches can be applied.
Enforce network segmentation so that only approved bank and partner endpoints can reach the Oracle Payments middle tier.

bash

# Example: restrict Oracle Payments File Transmission URI at an Apache/OHS reverse proxy
<LocationMatch "^/OA_HTML/.*FileTransmission.*">
    Require ip 10.10.20.0/24
    Require ip 203.0.113.0/28
</LocationMatch>