# CVE-2026-70702: Oracle E-Business Suite Payments unauthenticated data access in File Transmission

Source: https://junglewise.ai/threats/cve-2026-70702-oracle-e-business-suite-payments-unauthenticated-data-access-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70702 · Severity: high · CVSS 8.2 · Published 2026-08-18

Oracle E-Business Suite Payments is a component handling payment processing and financial transactions for enterprise resource planning systems. An unauthenticated attacker can exploit a vulnerability in the File Transmission component via HTTP to gain unauthorized access to sensitive payment and financial data, including the ability to view, modify, or delete critical information without requiring valid credentials.

Technologies: [Oracle E-Business Suite Payments](https://junglewise.ai/threats/technologies/e-business-suite-payments), [Oracle Payments](https://junglewise.ai/threats/technologies/payments). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-70702 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70702 being exploited in the wild.

**How severe is CVE-2026-70702?** High severity, with a CVSS score of 8.2, published 18 August 2026.

**Which products and versions are affected?** Oracle E-Business Suite Payments 12.2.3 through 12.2.15.

**Is there a fix for CVE-2026-70702?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-70702 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-70702?** Check whether you run Oracle E-Business Suite Payments or Oracle Payments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated network-accessible flaw in the File Transmission component of Oracle E-Business Suite Payments. An attacker with network access to the HTTP interface can exploit this vulnerability without authentication to achieve unauthorized read and limited write access to payment data. The attack requires no user interaction and has a low attack complexity. Affected versions include Oracle E-Business Suite 12.2.3 through 12.2.15. Oracle has released security updates to remediate this issue.

## Affected products

- Oracle E-Business Suite Payments 12.2.3 through 12.2.15

## Timeline

- 2026-08-18: disclosed

## References

- [https://www.oracle.com/security-alerts/cspuaug2026.html](https://www.oracle.com/security-alerts/cspuaug2026.html)

## Related threats

- [Oracle Payments authentication bypass in File Transmission](https://junglewise.ai/threats/cve-2026-70699-oracle-payments-authentication-bypass-in-file-transmission)
- [Oracle Payments File Transmission unauthorized data access](https://junglewise.ai/threats/cve-2026-70696-oracle-payments-file-transmission-unauthorized-data-access)
- [Oracle Payments data access vulnerability in File Transmission](https://junglewise.ai/threats/cve-2026-70695-oracle-payments-data-access-vulnerability-in-file-transmission)
- [Oracle E-Business Suite Oracle Payments access control weakness in File Transmission](https://junglewise.ai/threats/cve-2026-70694-oracle-e-business-suite-oracle-payments-access-control-weakness)
- [Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported…](https://junglewise.ai/threats/cve-2026-60782-vulnerability-in-the-oracle-payments-product-of-oracle-e-business)