---
schema: 1
kind: vulnerability
title: "CVE-2026-46817 — Oracle E-Business Suite (Oracle Payments): pre-auth RCE now exploited in the wild"
headline: "CVE-2026-46817 — Oracle E-Business Suite (Oracle Payments): pre-auth RCE now exploited in the wild"
summary: "Oracle E-Business Suite CVE-2026-46817 (CVSS 9.8) is now exploited in the wild — a pre-auth RCE in the Oracle Payments File Transmission component, patched in the May 2026 CPU, drew its first confirmed live exploitation against internet-facing honeypots over the weekend of 27–28 June, six weeks after the fix and before any public PoC existed (BleepingComputer, 2026-06-29). Details in § 5."
discovered_at: "2026-07-01T04:41:16Z"
event_date: 2026-06-30
run_id: 2026-07-01-af9e697d
priority: high
immediate_action: null
tags:
  - vulnerabilities
  - actively-exploited
  - pre-auth
  - rce
regions:
  - global
sectors:
  - finance
  - public-sector
  - education
entities: []
cves:
  - id: CVE-2026-46817
    cvss: "9.8"
    epss: null
    type: rce
    vector: zero-click
    auth: pre-auth
    status:
      - exploited
      - patch-available
sources:
  - url: "https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/"
    publisher: BleepingComputer
    role: primary
  - url: "https://securityaffairs.com/194463/security/attackers-actively-exploit-the-oracle-e-business-suite-flaw-cve-2026-46817.html"
    publisher: SecurityAffairs
    role: corroborating
closed_sources: []
evidence:
  - quote: "Critical (CVSS 9.8) unauthenticated RCE in the File Transmission component of Oracle Payments within Oracle E-Business Suite 12.2.3–12.2.15, allowing a remote attacker with HTTP network access to take over Oracle Payments via a low-complexity attack; patched in the May 2026 Critical Patch Update."
    publisher: ctipilot v2 brief (migrated)
verification: multi-source
sourcing_note: "migration: evidence backfilled from v2 brief body (item predates the Evidence footer field)"
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions:
  - "**Patch Oracle E-Business Suite now if the May 2026 CPU is not applied** — CVE-2026-46817 is under confirmed in-the-wild exploitation (§ 5). Remove Oracle Payments / EBS web interfaces from public internet reachability and review the Payments web tier's access logs for anomalous unauthenticated HTTP requests."
migrated_from: briefs/2026-07-01.md
---

Critical (CVSS 9.8) unauthenticated RCE in the *File Transmission* component of Oracle Payments within Oracle E-Business Suite 12.2.3–12.2.15, allowing a remote attacker with HTTP network access to take over Oracle Payments via a low-complexity attack; patched in the May 2026 Critical Patch Update. Threat-intel firm Defused reported the first confirmed in-the-wild exploitation against its Oracle EBS honeypots, with the first attempts observed over the weekend of 27–28 June — roughly six weeks post-patch, and with the vulnerability having "no known previous exploitation and no public POC code" until then ([BleepingComputer, 2026-06-29](https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/) · [SecurityAffairs, 2026-06-30](https://securityaffairs.com/194463/security/attackers-actively-exploit-the-oracle-e-business-suite-flaw-cve-2026-46817.html)). Defused did not publicly disclose the technical mechanics; exploitation is so far confirmed only against honeypots and is not attributed to a named cluster. Exposure and defender guidance in § 5.