--- schema: 1 kind: vulnerability title: "CVE-2026-46817 — Oracle E-Business Suite (Payments): unauthenticated RCE now CISA KEV-listed after quiet in-the-wild exploitation (CVSS 9.8)" headline: "Oracle E-Business Suite Payments pre-auth takeover (CVE-2026-46817) confirmed exploited and KEV-listed — patch or pull exposed instances off the internet" summary: > CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on 2026-07-15, the first formal confirmation of active exploitation for an unauthenticated flaw in the File Transmission component of Oracle Payments (the payment engine inside Oracle E-Business Suite 12.2.3–12.2.15) that Oracle patched quietly in its May 2026 Critical Patch Update. It is reachable over plain HTTP with no authentication (CVSS 9.8); any internet-facing EBS instance not on the May fix should be patched or taken off the public internet now, and treated as potentially compromised if it was exposed after 2026-05-28. discovered_at: "2026-07-16T04:35:00Z" event_date: "2026-07-15" run_id: 2026-07-16T0409Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, pre-auth, actively-exploited, cisa-kev, patch-available] regions: [global] sectors: [finance, public-sector] entities: [] techniques: [T1190] affected_products: ["Oracle E-Business Suite", "Oracle Payments"] cves: - id: CVE-2026-46817 cvss: "9.8" epss: null type: rce vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "Oracle E-Business Suite 12.2.3–12.2.15" fixed: "Oracle Critical Patch Update, May 2026" sources: - url: "https://www.oracle.com/security-alerts/cspumay2026.html" publisher: "Oracle (Critical Patch Update Advisory, May 2026)" date: "2026-05-28" role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog" publisher: "CISA" date: "2026-07-15" role: primary - url: "https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/" publisher: "Help Net Security (citing Defused)" date: "2026-06-30" role: corroborating closed_sources: [] evidence: - quote: "On 27 June 2026 our Oracle E-Business Suite decoys recorded the first in-the-wild exploitation of CVE-2026-46817 — roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed." publisher: "Help Net Security (citing Defused)" - quote: "The exploit targets the ibytransmit endpoint in Oracle Payments' File Transmission component, and calls an internal Oracle Java function directly, redirecting it to read a file (/etc/passwd) from the server." publisher: "Help Net Security" - quote: "CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation." publisher: "CISA" verification: multi-source sourcing_note: "CISA KEV listing (2026-07-15) confirms active exploitation; Oracle's May 2026 CPU is the vendor primary for the fix; Defused (via Help Net Security) supplies the exploitation observation and endpoint detail. Oracle rates the flaw a full compromise/takeover (CVSS 9.8, C:H/I:H/A:H); the single observed in-the-wild attempt used it for an unauthenticated arbitrary file read, which the researchers note can be repointed at credential/key files." confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Apply Oracle's May 2026 Critical Patch Update to every Oracle E-Business Suite 12.2.3–12.2.15 instance now; until patched, remove the EBS web tier (Oracle Payments) from public internet exposure." - "Treat any internet-facing EBS instance left unpatched since 2026-05-28 as potentially compromised — review web-access logs for POST requests to /OA_HTML/ibytransmit and, on any hit, run a forensic review and rotate every credential/key stored on that host." migrated_from: null --- CISA added **CVE-2026-46817** to its Known Exploited Vulnerabilities catalog on 15 July 2026, the first formal confirmation of active exploitation for a flaw Oracle patched without fanfare in its May 2026 Critical Patch Update ([CISA, 2026-07-15](https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The bug sits in the File Transmission component of **Oracle Payments** — the payment-processing engine built into Oracle E-Business Suite — and Oracle characterises it as improper privilege management, improper authentication and missing authentication for a critical function that an unauthenticated attacker with HTTP network access can use to compromise and take over Oracle Payments (CVSS 9.8; [Oracle CPU, 2026-05-28](https://www.oracle.com/security-alerts/cspumay2026.html)). Affected releases are EBS 12.2.3 through 12.2.15. Threat-intelligence firm Defused recorded the first in-the-wild exploitation against its EBS honeypot decoys on **27 June 2026** — roughly six weeks after the patch and before any public proof-of-concept existed — as a single source running an unauthenticated file read against the Payments component rather than broad scanning ([Help Net Security, 2026-06-30](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/)). The observed technique calls the `ibytransmit` endpoint in the File Transmission component, invoking an internal Oracle Java function directly and redirecting it to read `/etc/passwd`; the same primitive can be pointed at configuration files holding database credentials, encryption keys or payment-processor API keys ([Help Net Security, 2026-06-30](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/)). This is the same EBS product family already under sustained ShinyHunters/UNC6240 extortion pressure and the latest in a now-annual cadence of critical, remotely exploitable EBS flaws. **Defender takeaway:** EBS is a common finance and public-sector back-office platform across Europe, and this is a pre-auth, no-interaction path to full compromise on the exposed web tier. In web-access-log telemetry, surface POST requests to `/OA_HTML/ibytransmit` — especially from unexpected sources against any instance that was internet-reachable after the 28 May patch date — and treat such an instance as potentially compromised, investigating before (not after) rotating the credentials and keys stored on the host. The recurring exploitation pattern is itself reason to question whether any EBS component needs to remain internet-facing. The CISA KEV entry is the exploitation signal used here; the associated federal remediation deadline is a US-agency compliance date and carries no operational weight for this audience.