Oracle disclosed a critical (CVSS 9.8) flaw in the File Transmission component of Oracle Payments that lets a remote, unauthenticated attacker take over the product over HTTP.
What Is It
CVE-2026-60782 is a vulnerability in the Oracle Payments product of Oracle E-Business Suite, specifically the File Transmission component. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful exploitation results in full takeover of Oracle Payments.
The CVSS 3.1 base score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability metric is at its worst setting: network attack vector, low attack complexity, no privileges required, and no user interaction. The impact side is equally bad; high confidentiality, integrity, and availability impact, with unchanged scope.
Why It Matters
The combination of zero authentication, low complexity, and network reachability over HTTP puts this in the class of bugs that require no foothold and no user to click anything. The phrasing Oracle uses, "easily exploitable" and "takeover", is the vendor's standard Critical Patch Update template language for this severity class rather than a special signal, but the CVSS metrics behind it are unambiguous.
Oracle Payments handles payment processing functions within EBS, and the affected component handles file transmission, so exposure will depend on how a given deployment integrates and network-restricts that component. An attacker achieving takeover gains high impact across confidentiality, integrity, and availability of that product.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Payments (Oracle E-Business Suite)
- Component: File Transmission
- Affected versions: 12.2.3 through 12.2.15
No CPE data was published in the NVD record at time of writing.
Patch Status
The CVE record was published 2026-08-18 with a vulnerability status of Received, meaning NVD analysis is not yet complete. Oracle has historically shipped Critical Patch Updates on a quarterly cadence, January, April, July, and October, so the July 2026 Critical Patch Update advisory is the first place to check for the fix and applicable patch levels for versions 12.2.3–12.2.15. Note that the CVE publication date falls after that CPU, so the fix may instead land in the October 2026 CPU or in an out-of-cycle Security Alert; confirm against the CPU advisory itself rather than assuming coverage, and check both channels.
The data reviewed for this brief contains no CISA KEV entry for CVE-2026-60782, and this was not independently verified against the live KEV catalog; treat the KEV status as unconfirmed either way rather than as evidence of no exploitation. If the CVE is not listed, no KEV remediation deadline or required action would apply. Given the severity and the unauthenticated attack path, patching should not wait on a KEV listing.
Sources
- NVD, CVE-2026-60782: https://nvd.nist.gov/vuln/detail/CVE-2026-60782
- Oracle Critical Patch Update Advisory (July 2026): https://www.oracle.com/security-alerts/cpujul2026.html