CVE-2026-46817 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-05-28

Added to CISA KEV: 2026-07-15 48 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity, and audit Oracle Payments File Transmission logs for anomalous HTTP requests.
Apply the Oracle May 2026 Critical Patch Update (CSPU) immediately for all affected EBS/Payments versions 12.2.3-12.2.15
Restrict external/internet access to the Oracle Payments File Transmission HTTP endpoint until patched; enforce network segmentation and WAF rules as interim mitigation
Monitor for unauthorized file transmissions, unexpected privilege escalations, and unusual outbound connections from EBS servers
Patch priority: CRITICAL/URGENT - patch immediately given active exploitation and CISA KEV listing with mandated remediation deadlines

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-46817 is a critical vulnerability (CVSS 9.8) affecting the File Transmission component of the Oracle Payments module within Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15 ^[4]^[6]. The flaw stems from improper privilege management and authentication handling, which matters significantly because it allows an unauthenticated, remote attacker to compromise the Oracle Payments component via simple HTTP requests, potentially leading to a full system takeover ^[2]^[5].

Exploitation

Active Exploitation: The vulnerability has been confirmed as actively exploited in the wild ^[6].
Known Campaigns: It has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active use by threat actors in cyberattacks ^[7].
Proof-of-Concept/Exploit Tooling: While specific public exploit code is widely discussed in security circles, the ease of exploitability (no authentication required) has led to rapid development of automated exploitation attempts ^[3].
Attack Prerequisites:

* Network vs Local: Network-based; the attacker requires network access to the target system. * Authentication: None required (unauthenticated). * User Interaction: None required.

Affected Products & Patches

Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.15 ^[4].
Patch Availability: A patch was released by Oracle as part of the May 2026 Critical Security Patch Update (CSPU) ^[8].
Mitigations/Workarounds:

* Restrict or block external HTTP access to the affected File Transmission endpoint until patches are verified as applied ^[1]. * Implement strict network segmentation to ensure only trusted internal services can reach the Oracle Payments component ^[1]. * Monitor system logs and network traffic for suspicious file transfer or unauthorized access patterns ^[1].

Impact

Access & Capability: Successful exploitation grants an attacker full control over the Oracle Payments component, enabling them to bypass authentication and manipulate sensitive financial file transmissions ^[2].
Business Risk: Internet-facing deployments are at extreme risk of unauthorized data exfiltration, financial fraud, and potential full-system compromise, which can lead to significant operational disruption, loss of integrity in financial records, and regulatory compliance failures.

Sources

CVE-2026-46817 - Vulnerability Details - OpenCVE
Apply the latest Oracle Payments patch that includes the fix for CVE‑2026‑46817. Restrict or block external HTTP access to the File Transmission endpoint until the patch is applied. Implement network segmentation so that only trusted internal services can reach Oracle Payments and monitor for suspic…
CVE-2026-46817: Oracle E-Business Suite Unauthenticated Remote Takeover ...
CVE-2026-46817 is a critical unauthenticated remote takeover vulnerability in Oracle E-Business Suite (EBS), specifically in the Oracle Payments component. Oracle has characterized this vulnerability as “easily exploitable,” allowing an unauthenticated attacker with network access to completely comp…
CVE-2026-46817 allows unauthenticated takeover of ...
CVE-2026-46817 allows unauthenticated takeover of Oracle Payments (and exploitation chatter is already starting) · Zero login required: It ...
NVD-CVE-2026-46817
CVE-2026-46817 Detail Description Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromi…
Attackers Hit Oracle EBS CVE-2026-46817 Days After Patch
CVE-2026-46817’s Unauthenticated Route Into Oracle Payments CVE-2026-46817 is an improper privilege management and authentication vulnerability in the File Transmission component of Oracle Payments, a module embedded within Oracle E-Business Suite versions 12.2.3 through 12.2.15.

🔴 CVE-2026-46817