CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Oracle Payments

product · product:oracle-payments

Coverage
1
first 2026-07-16 → last 2026-10-11
Latest activity
2026-07-16
Oracle E-Business Suite Payments pre-auth takeover (CVE-2026-46817) confirmed exploited and KEV-listed, patch…
Peak priority
high
1 high
Targets
finance
sectors: finance
Sources cited
6
4 hosts

Action items (1)

Do-now tasks recorded on the entries about Oracle Payments, newest first. Check the date before acting on an older one.

  • Apply Oracle's May 2026 Critical Security Patch Update to every Oracle E-Business Suite 12.2.3–12.2.15 instance now; until patched, remove the EBS web tier (Oracle Payments) from public internet exposure.
    2026-07-16CVE-2026-46817

Defender insights

What each entry about Oracle Payments tells a defender to do, newest first.

2026-07-16HIGHexploitedOracle E-Business Suite Payments pre-auth takeover (CVE-2026-46817) confirmed exploited and KEV-listed, patch or pull exposed instances off the internet

Story timeline

  1. 2026-07-16CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)
    trending-vulnerabilitiesOracle E-Business Suite Payments pre-auth takeover (CVE-2026-46817) confirmed exploited and KEV-listed, patch or pull exposed instances off the internet

Hunting pivots

CVEs (exploited first)
CVE-2026-46817
Releases covered
Oracle Payments
Tags
actively-exploitedcisa-kevpatch-availablepre-authvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-16/cve-2026-46817-oracle-ebs-payments-preauth-rce-kev-listed · ATT&CK page ↗

Entries about Oracle Payments (1)

2026-07-16 · view entry permalink →

HIGHCVE-2026-46817exploitedupdatedNATOA1

CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)

CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on 15 July 2026 on evidence of active exploitation (CISA, 2026-07-15); Oracle had fixed the flaw in its May 2026 Critical Security Patch Update (Oracle CSPU, 2026-05-21). The bug sits in the File Transmission component of Oracle Payments (CVSS 9.8) (Oracle CSPU, 2026-05-21), the payment-processing engine built into Oracle E-Business Suite (Help Net Security, 2026-06-30), and an unauthenticated attacker with HTTP network access can use it to compromise and take over Oracle Payments (Oracle CSPU risk matrix text); CISA's catalog classifies it as improper privilege management, improper authentication and missing authentication for a critical function (CISA KEV catalog, 2026-07-15). Affected releases are EBS 12.2.3 through 12.2.15.

Threat-intelligence firm Defused recorded the first in-the-wild exploitation against its EBS honeypot decoys on 27 June 2026 (roughly six weeks after the patch and before any public proof-of-concept existed) as a single source running an unauthenticated file read against the Payments component rather than broad scanning (Help Net Security, 2026-06-30). The observed technique calls the ibytransmit endpoint in the File Transmission component, invoking an internal Oracle Java function directly and redirecting it to read /etc/passwd; the same primitive can be pointed at configuration files holding database credentials, encryption keys or payment-processor API keys (Help Net Security, 2026-06-30).

On 27 June 2026 our Oracle E-Business Suite decoys recorded the first in-the-wild exploitation of CVE-2026-46817; roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed.

Help Net Security (citing Defused) 2026-06-30

The exploit targets the ibytransmit endpoint in Oracle Payments' File Transmission component, and calls an internal Oracle Java function directly, redirecting it to read a file (/etc/passwd) from the server.

Help Net Security

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.

CISA 2026-07-15
Correctionrun 2026-10-11T1307Z-audittitlesummarytagssectorscvessourcesactionsbodysourcing_note

Oracle and CISA describe CVE-2026-46817 as an unauthenticated takeover of Oracle Payments (Oracle CSPU, 2026-05-21) (CISA KEV catalog, 2026-07-15), and the exploitation Defused observed was a file read, so the earlier wording of remote code execution went beyond the sources. No cited source links ShinyHunters or UNC6240 to Oracle E-Business Suite. Shadowserver tracks more than 450 EBS instances online (BleepingComputer, 2026-06-29).

vulnerability16 Jul 04:35Zmulti-sourceOpen finding →
Sources: Oracle (Critical Security Patch Update Advisory, May 2026) · CISA · BleepingComputer · CISA KEV catalog · Help Net Security (citing Defused) · Oracle

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • cisa.gov2 (33%)
  • oracle.com2 (33%)
  • bleepingcomputer.com1 (17%)
  • helpnetsecurity.com1 (17%)
All cited sources (6)