CVE-2026-46817: Oracle E-Business Suite Payments unauthenticated takeover, exploited in the wild and CISA KEV-listed (CVSS 9.8)
Oracle E-Business Suite Payments pre-auth takeover (CVE-2026-46817) confirmed exploited and KEV-listed, patch or pull exposed instances off the internet
Defender actions
- Apply Oracle's May 2026 Critical Security Patch Update to every Oracle E-Business Suite 12.2.3–12.2.15 instance now; until patched, remove the EBS web tier (Oracle Payments) from public internet exposure.
Analysis
CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on 15 July 2026 on evidence of active exploitation (CISA, 2026-07-15); Oracle had fixed the flaw in its May 2026 Critical Security Patch Update (Oracle CSPU, 2026-05-21). The bug sits in the File Transmission component of Oracle Payments (CVSS 9.8) (Oracle CSPU, 2026-05-21), the payment-processing engine built into Oracle E-Business Suite (Help Net Security, 2026-06-30), and an unauthenticated attacker with HTTP network access can use it to compromise and take over Oracle Payments (Oracle CSPU risk matrix text); CISA's catalog classifies it as improper privilege management, improper authentication and missing authentication for a critical function (CISA KEV catalog, 2026-07-15). Affected releases are EBS 12.2.3 through 12.2.15.
Threat-intelligence firm Defused recorded the first in-the-wild exploitation against its EBS honeypot decoys on 27 June 2026 (roughly six weeks after the patch and before any public proof-of-concept existed) as a single source running an unauthenticated file read against the Payments component rather than broad scanning (Help Net Security, 2026-06-30). The observed technique calls the ibytransmit endpoint in the File Transmission component, invoking an internal Oracle Java function directly and redirecting it to read /etc/passwd; the same primitive can be pointed at configuration files holding database credentials, encryption keys or payment-processor API keys (Help Net Security, 2026-06-30).
Cited evidence
On 27 June 2026 our Oracle E-Business Suite decoys recorded the first in-the-wild exploitation of CVE-2026-46817; roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed.
The exploit targets the ibytransmit endpoint in Oracle Payments' File Transmission component, and calls an internal Oracle Java function directly, redirecting it to read a file (/etc/passwd) from the server.
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
Updates1
Oracle and CISA describe CVE-2026-46817 as an unauthenticated takeover of Oracle Payments (Oracle CSPU, 2026-05-21) (CISA KEV catalog, 2026-07-15), and the exploitation Defused observed was a file read, so the earlier wording of remote code execution went beyond the sources. No cited source links ShinyHunters or UNC6240 to Oracle E-Business Suite. Shadowserver tracks more than 450 EBS instances online (BleepingComputer, 2026-06-29).
Sources6
Revision history
- Published 2026-07-16T0409Z-intel
- Correction 2026-10-11T1307Z-audit
The title and CVE type called the flaw code execution, but Oracle and CISA describe a takeover of Oracle Payments and the observed exploit is a file read. The fix is Oracle's May 2026 Critical Security Patch Update, not a quietly shipped Critical Patch Update; the CWE wording comes from CISA's catalog, not Oracle; no source ties ShinyHunters or UNC6240 to EBS; and the European public-sector prevalence claim is replaced by Shadowserver's exposure count. The entry gains BleepingComputer and the KEV record as sources, the KEV forensic-triage flag, and a shorter hunt action. The Oracle advisory is dated 2026-05-21, its own date; 28 May is Help Net Security's compromise-assessment threshold, not a patch date; the patch action names the Critical Security Patch Update, and a hunting action that restated the Detection line is dropped. The sourcing note names the Critical Security Patch Update too, and the KEV listing is described as CISA states it, on evidence of active exploitation, without calling it the first confirmation.
Changed: title summary tags sectors cves sources actions body sourcing_note
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.