Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild

1. Executive summary

A critical vulnerability in Oracle E-Business Suite (EBS) Oracle Payments — CVE-2026-46817 (CVSS 9.8 CRITICAL; CWE-269 Improper Privilege Management, CWE-287 Improper Authentication) — is being actively exploited in the wild. The flaw permits an unauthenticated attacker with network access via HTTP to compromise Oracle Payments and achieve full takeover of susceptible instances. Affected versions are 12.2.3 through 12.2.15. Oracle shipped patches in last month's Critical Security Patch Update. The vulnerability is NOT currently listed in CISA KEV and EPSS is 0%, though honeypot observations by Defused Cyber confirm active exploitation as of late June 2026. EMEA financial services running unpatched Oracle EBS Payments modules face immediate risk of financial-data compromise and instance takeover.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Active exploitation of a CVSS 9.8 flaw in a core financial application (Oracle EBS Payments) — institutions running unpatched instances must treat this as a potential ICT-related incident	Activate incident management process; assess whether the institution's Oracle EBS environment is exposed and whether exploitation has occurred
DORA Art. 18: classification of ICT-related incidents and cyber threats	CVSS 9.8 CRITICAL, active in-the-wild exploitation confirmed via honeypot observations	Classify as a high-severity cyber threat; determine if a major incident threshold is met based on data sensitivity and business impact
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If exploitation is confirmed on the institution's infrastructure, the CVSS 9.8 nature and financial-data access potential may meet the major incident threshold	Prepare notification to competent authorities if compromise is detected
DORA Art. 28: ICT third-party risk — general principles	Oracle is an ICT third-party provider; the vulnerability is in Oracle's product and patches were issued by Oracle	Review vendor patch management SLA; confirm patch deployment timeline with Oracle support contracts
NIS2 Art. 21(2)(d): supply chain security measures	Vulnerability in Oracle EBS — a third-party software component in the supply chain	Ensure vulnerability management processes cover Oracle EBS patching; verify patch deployment
NIS2 Art. 23: incident reporting obligations	Active exploitation confirmed; if an NIS2-entity's systems are compromised, incident reporting obligations may be triggered	Prepare incident notification channels if exploitation is detected on in-scope systems

3. Technical analysis & attack chain

Vulnerability details

CVE: CVE-2026-46817
CVSS: 9.8 CRITICAL (authoritative per NVD/verified reference data)
CWEs: CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication)
Affected product: Oracle Payments component of Oracle E-Business Suite
Affected versions: 12.2.3 through 12.2.15
Access vector: Unauthenticated attacker with network access via HTTP
Impact: Takeover of Oracle Payments — unauthorized creation, deletion, or modification access to critical data or all Oracle Payments accessible data, and unauthorized access to critical data or complete access to all Oracle Payments accessible data
Exploitability: Described as "easily exploitable" in NVD description
Patch status: Oracle shipped fixes in last month's Critical Security Patch Update

Discrepancy note

GitHub Security Advisory GHSA-2f6j-3xh8-jcv7 describes the Oracle Payments File Transmission component vulnerability with CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and labels it "difficult to exploit." The verified reference data (NVD) records CVSS 9.8 CRITICAL with CWE-269/CWE-287 and the NVD description states "easily exploitable." This discrepancy may reflect different scoring of the same underlying flaw or a related component advisory. The CVSS 9.8 CRITICAL value from the verified reference data is authoritative for this advisory. Both classifications describe an authentication/privilege flaw in Oracle Payments; the NVD scoring reflects the more severe assessment.

Multiple GitHub Security Advisories reference related vulnerabilities in Oracle EBS components affecting versions 12.2.3–12.2.15 (and 12.2.6–12.2.15 in one case). These are distinct CVEs but part of the same Oracle Critical Security Patch Update:

GHSA-5cj7-j9h7-83x4: Oracle Public Sector Financials (International), component: Authorization. CVSS 8.8. Low-privileged attacker via HTTP. Result: takeover.
GHSA-m6mc-rc7h-2r2x: Oracle Public Sector Financials (International), component: Authorization. CVSS 7.7. Low-privileged attacker via HTTPS. Scope change noted. Result: unauthorized access to critical data.
GHSA-jx22-7r5f-hj3r: Oracle Quality, component: Internal Operations. CVSS 8.8. Low-privileged attacker via HTTP. Result: takeover.
GHSA-r6ff-f8fv-xc96: Oracle Payroll, component: Internal Operations. CVSS 8.1. Low-privileged attacker via HTTP. Result: unauthorized creation, deletion, or modification access to critical data.

These related advisories are single-sourced (GitHub Security Advisories); verify against Oracle's CPU before enforcement.

Attack chain (confirmed steps)

Reconnaissance: Attacker identifies internet-facing Oracle EBS instance running Oracle Payments module, versions 12.2.3–12.2.15, accessible over HTTP.
Initial access: Unauthenticated attacker sends crafted HTTP request(s) targeting the Oracle Payments component, exploiting the improper privilege management and authentication flaw (CWE-269/CWE-287).
Compromise: Successful exploitation results in takeover of Oracle Payments — the attacker gains unauthorized access to all Oracle Payments accessible data, including creation, deletion, and modification capabilities.
Data access: Attacker can access, exfiltrate, or modify critical financial payment data stored in or processed by Oracle Payments.

Unconfirmed / single-sourced claims

Active exploitation attribution: Defused Cyber reported honeypot exploitation "over the weekend" of late June 2026. No threat actor attribution is available. No named actor has a MITRE profile in the verified reference data. Attribution is unconfirmed.
Exploit mechanism: No technical details on how the vulnerability is being exploited are publicly available. No public PoC code exists. Defused Cyber stated "this vulnerability has no known previous exploitation and no public PoC code exists."
Campaign scope: It is unknown whether exploitation is opportunistic or part of a targeted campaign.
Historical context (single-sourced to The Hacker News): A related critical flaw in the same product, CVE-2025-61882 (CVSS 9.8), was previously weaponized by threat actors linked to the Cl0p ransomware operation, with attacks from August 2025. This historical precedent is noted but does not confirm current exploitation is ransomware-related.

4. Mitigation & containment

P1 — Within 24 hours

Identify exposed instances: Inventory all Oracle EBS deployments. Identify any running versions 12.2.3 through 12.2.15 with the Oracle Payments module exposed to network access (especially HTTP). - Check version: SELECT * FROM FND_PRODUCT_INSTALLATIONS WHERE PRODUCT_CODE = 'PAY'; or review Oracle EBS version via the "About This Page" or AD_APPLIED_PATCHES table.
Block external access: If Oracle EBS Payments is internet-facing, immediately restrict access at the network layer: - Firewall rules: Block HTTP (port 80) and HTTPS (port 443) to the Oracle EBS application server from all untrusted networks (internet, DMZ). - Reverse proxy/WAF: Restrict access to Oracle EBS endpoints to authenticated VPN/zero-trust network segments only. - If the Payments module is not required externally, disable or block its specific endpoints.
Check for signs of compromise: Review Oracle EBS application logs, Oracle Payments module logs, web server access logs (OHS/Apache), and database audit logs for: - Unusual HTTP requests to Oracle Payments endpoints - Unauthenticated or anomalous session creation - Unexpected data modification or access patterns in Oracle Payments tables - Review FND_LOG_MESSAGES, FND_CONCURRENT_REQUESTS, and Oracle HTTP Server access_log/error_log.

P2 — Within 72 hours

Apply Oracle Critical Security Patch Update: Deploy the patch from Oracle's most recent CPU (released approximately May 2026) that addresses CVE-2026-46817. Obtain the patch via My Oracle Support. - Verify patch application: SELECT * FROM AD_APPLIED_PATCHES WHERE PATCH_NAME = '<patch_number>';
Patch related vulnerabilities: Apply patches for the related component vulnerabilities in the same CPU: - Oracle Public Sector Financials (International) — Authorization component - Oracle Quality — Internal Operations component - Oracle Payroll — Internal Operations component
Harden authentication: Review and enforce strong authentication controls on Oracle EBS, including: - Enforce HTTPS for all Oracle EBS access (disable HTTP) - Implement Oracle EBS-specific hardening per Oracle's EBS Security Guide - Review and restrict Oracle Payments module privileges per least-privilege principle

P3 — Within 7 days

Network segmentation: Ensure Oracle EBS is isolated within internal network segments with strict east-west controls. The application server should not be reachable from untrusted networks.
EDR / monitoring: Deploy enhanced monitoring on Oracle EBS application and database servers: - Monitor for unexpected process execution on the application server - Alert on anomalous database queries against Oracle Payments tables - Monitor for unexpected file creation or modification on the application server filesystem
Assume compromise review: Per the advice of security researchers cited in the source material, assume compromise and conduct a retrospective review: - Determine whether access was obtained before patches were applied - Identify what data was accessed - Determine whether persistence was established
Vendor coordination: Confirm patch deployment with Oracle support. Review Oracle's CPU documentation for any post-patch configuration steps.

5. Indicators of compromise

No indicators of compromise available in the source material. The source states that no details are available on how the vulnerability is being exploited. No specific IOCs (IPs, domains, hashes, file names, or command-line artifacts) have been published by Defused Cyber or any other source at the time of this advisory.

6. Detection

Insufficient indicators to author detection rules. The sources contain no specific IOCs, file names, command-line artifacts, mutex names, registry keys, or network indicators associated with the active exploitation. No public PoC code exists. Defused Cyber has not released technical details of the observed exploitation.

Recommended behavioural detection approach (derived from vulnerability characteristics, not source IOCs)

Monitor Oracle HTTP Server (OHS) access logs for unauthenticated HTTP requests to Oracle Payments endpoints from unexpected source IPs
Alert on session creation in Oracle EBS without corresponding authentication events
Monitor Oracle Payments database tables for unexpected DML operations (INSERT, UPDATE, DELETE) outside business hours or from unexpected session sources
Correlate with network logs showing HTTP (not HTTPS) access to Oracle EBS from external/untrusted IP ranges

These behavioural detections are inferred from the vulnerability description and are not based on source-provided IOCs. Validate against your environment before enforcement.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-46817	9.8 Critical	—	0%	Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions tha…

7. Sources

The Hacker News — "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild" — https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html — 2026-06-30
BleepingComputer — "Hackers now exploit critical Oracle E-Business flaw in attacks" — https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/ — 2026-06-30
GitHub Security Advisories — "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission)" — https://github.com/advisories/GHSA-2f6j-3xh8-jcv7 — accessed 2026-06-30
GitHub Security Advisories — "Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization)" — https://github.com/advisories/GHSA-5cj7-j9h7-83x4 — accessed 2026-06-30
GitHub Security Advisories — "Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization)" — https://github.com/advisories/GHSA-m6mc-rc7h-2r2x — accessed 2026-06-30
GitHub Security Advisories — "Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations)" — https://github.com/advisories/GHSA-jx22-7r5f-hj3r — accessed 2026-06-30
GitHub Security Advisories — "Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations)" — https://github.com/advisories/GHSA-r6ff-f8fv-xc96 — accessed 2026-06-30

8. Adverse Trace position

Severity assessment: CVSS 9.8 CRITICAL per verified NVD reference data. The vulnerability is easily exploitable, requires no authentication, and grants full takeover of Oracle Payments — a core financial processing module. Active exploitation is confirmed via honeypot observations by Defused Cyber (single-sourced; verify before enforcement). No CISA KEV listing exists and EPSS is 0%, which does not reflect the confirmed honeypot exploitation activity. The discrepancy between the GitHub advisory (CVSS 7.4, "difficult to exploit") and NVD (CVSS 9.8, "easily exploitable") is noted; the NVD assessment is authoritative. Client-impact assessment: EMEA financial services running Oracle EBS versions 12.2.3–12.2.15 with the Payments module exposed to network access are at immediate risk. Institutions that have already applied the May 2026 Oracle Critical Security Patch Update are protected. Institutions that have not patched should treat this as a P1 incident: restrict network access immediately, then patch. The historical precedent of CVE-2025-61882 in the same product being weaponized by Cl0p ransomware operators elevates concern, though no ransomware connection has been established for CVE-2026-46817. What we will do next: Adverse Trace will monitor for IOC releases from Defused Cyber, Oracle, or other threat intelligence publishers. If IOCs emerge, we will issue an updated advisory with detection rules. We will also monitor for CISA KEV addition and any confirmed threat actor attribution. Clients with Oracle EBS environments should report patch status to their Adverse Trace account manager within 72 hours.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.