Vulnerability record · CVE-2026-46943 · published 21 July 2026

CVE-2026-46943: Oracle retail eftlink improper access control vulnerability

Oracle · Retail Eftlink

Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail EFTLink. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Retail EFTLink accessible data as well as unauthorized access to critical data or complete access to all Oracle Retail EFTLink accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

7.4 CVSS 3.1 High EPSS 0.34% · top 75.1% CWE-284 · Improper access control

7.4CVSS 3.1 base score

0.34%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

1References

7 Aug 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Retail Eftlink Oracle

References

Link	Tags
https://www.oracle.com/security-alerts/cpujul2026.html	Vendor Advisory

Track CVE-2026-46943 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.1CVE-2017-12617Apache Tomcat Default Servlet JSP upload leads to remote code executionApache Tomcat with HTTP PUT enabled (for example, the Default servlet readonly parameter set to false) allows an attacker to upload a JSP file throug…KEVEPSS 100%analysed4 Oct 2017 7.5CVE-2021-42340Apache tomcat vulnerabilityThe fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memor…EPSS 12%14 Oct 2021 7.5CVE-2020-11979Apache ant vulnerabilityAs mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to …EPSS 8.0%1 Oct 2020 5.9CVE-2021-45105Apache Log4j2 uncontrolled recursion in self-referential lookups causes DoSApache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) fail to protect against uncontrolled recursion from self-referential lo…EPSS 100%analysed18 Dec 2021 5.5CVE-2021-36373Apache ant vulnerabilityWhen reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memo…EPSS 2.5%14 Jul 2021 5.5CVE-2021-36374Apache ant vulnerabilityWhen reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to…EPSS 2.6%14 Jul 2021 5.3CVE-2021-34429Eclipse Jetty URI encoding flaw exposes WEB-INF and bypasses security constraintsEclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 mishandle certain encoded characters in URIs, allowing crafted requests to reac…EPSS 99%analysed15 Jul 2021 4.8CVE-2020-27218Eclipse jetty vulnerabilityIn Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflat…EPSS 8.3%28 Nov 2020

Source: NIST National Vulnerability Database (record CVE-2026-46943), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.