CVE-2026-46818: Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission)

Synopsis

This is a high-severity vulnerability in the File Transmission component of Oracle Payments, part of Oracle E-Business Suite (versions 12.2.3 through 12.2.15). An unauthenticated attacker with network access over HTTPS can exploit this flaw, though exploitation requires meeting certain high-complexity conditions. Successful exploitation gives the attacker full read access to all Oracle Payments data and the ability to create, modify, or delete critical payment records. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Oracle publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Payments service over the network via HTTPS; the service must be exposed to the attacker's network.

• AuthenticationNot required

  No credentials or account of any kind are needed; the attacker can target the service as an unauthenticated party.

• Victim interactionNot required

  No user action or social engineering is required; the attacker operates entirely without victim participation.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must meet specific conditions such as race timing, non-default configuration state, or other environmental factors that are not fully under the attacker's control.

Blast Radius

• Reads all Oracle Payments accessible data, including stored payment records, account details, and transaction history.
• Reads critical subsets of Oracle Payments data that would not ordinarily be accessible to an unauthenticated party.
• Creates, modifies, or deletes critical payment data, enabling fraud, record tampering, or destruction of financial records.
• Modifies or deletes all Oracle Payments accessible data, with potential for broad disruption to payment processing operations.