Summary
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
- Vendor
- Oracle
- Product
- E-Business Suite
- Added to KEV
- Jul 15, 2026
- Remediation due
- Jul 18, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-269, CWE-287, CWE-306
- EPSS
- 12.3% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References