Oracle E-Business Suite / Oracle Payments File Transmission unauthenticated RCE/takeover (CVSS 9.8); CISA KEV 2026-07-15, exploited ITW since 2026-06-27; fixed Oracle May 2026 CPU (12.2.3-12.2.15)

CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)

CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on 15 July 2026 on evidence of active exploitation (CISA, 2026-07-15); Oracle had fixed the flaw in its May 2026 Critical Security Patch Update (Oracle CSPU, 2026-05-21). The bug sits in the File Transmission component of Oracle Payments (CVSS 9.8) (Oracle CSPU, 2026-05-21), the payment-processing engine built into Oracle E-Business Suite (Help Net Security, 2026-06-30), and an unauthenticated attacker with HTTP network access can use it to compromise and take over Oracle Payments (Oracle CSPU risk matrix text); CISA's catalog classifies it as improper privilege management, improper authentication and missing authentication for a critical function (CISA KEV catalog, 2026-07-15). Affected releases are EBS 12.2.3 through 12.2.15.

Threat-intelligence firm Defused recorded the first in-the-wild exploitation against its EBS honeypot decoys on 27 June 2026 (roughly six weeks after the patch and before any public proof-of-concept existed) as a single source running an unauthenticated file read against the Payments component rather than broad scanning (Help Net Security, 2026-06-30). The observed technique calls the ibytransmit endpoint in the File Transmission component, invoking an internal Oracle Java function directly and redirecting it to read /etc/passwd; the same primitive can be pointed at configuration files holding database credentials, encryption keys or payment-processor API keys (Help Net Security, 2026-06-30).