PT-2026-44513 · Oracle · Oracle Payments

Published 2026-05-28 · Updated 2026-06-04 · CVE-2026-46817

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payments versions 12.2.3 through 12.2.15

Description An issue exists in the File Transmission component of the Oracle Payments product. This flaw allows an unauthenticated attacker with network access via HTTP to compromise the system, potentially leading to a full takeover of Oracle Payments through remote code execution and authentication bypass.

Recommendations Update Oracle E-Business Suite Oracle Payments to a version later than 12.2.15.

Fix

RCE

Improper Authentication

Missing Authentication

Improper Privilege Management

Weakness Enumeration

CWE-287

CWE-306

CWE-269

Related Identifiers

CVE-2026-46817

Affected Products

Oracle Payments

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46817 · Security Note
• https://oracle.com/security-alerts/cspumay2026.html · Vendor Advisory
• https://twitter.com/CCBalert/status/2060378567616123285 · Twitter Post
• https://twitter.com/UpwindMDR/status/2060357947494940844 · Twitter Post
• https://t.me/cveNotify/165977 · Telegram Post
• https://twitter.com/dailycve/status/2062593106428489914 · Twitter Post