Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)

1. Executive summary

A critical vulnerability in Oracle E-Business Suite (EBS) Payments — CVE-2026-46817 (CVSS 9.8 CRITICAL, CWE-269 / CWE-287) — is being actively exploited in the wild. Threat intelligence firm Defused reports the first exploitation was recorded on 27 June 2026 against EBS decoys, approximately six weeks after Oracle's May 2026 Critical Security Patch Update and before any public proof-of-concept existed. The flaw resides in the File Transmission component of Oracle Payments (versions 12.2.3–12.2.15) and permits unauthenticated, remote file-read via the ibytransmit endpoint, potentially exposing database credentials, encryption keys, and payment processor API keys. EMEA financial services running internet-facing, unpatched EBS instances are at immediate risk of data compromise and financial-system takeover. The vulnerability is NOT currently listed in CISA KEV; EPSS is 1%.

2. Regulatory framing

3. Technical analysis & attack chain

**Confirmed attack chain (single-sourced; attributed to Defused threat intelligence — attribution is unconfirmed as no MITRE ATT&CK profile exists for "Defused"):

1. Initial access vector: Unauthenticated, remote attacker with network access via HTTP to an Oracle EBS instance running versions 12.2.3–12.2.15 with the Oracle Payments module.
2. Exploited component/endpoint: The ibytransmit endpoint in Oracle Payments' File Transmission component. The attacker sends a crafted POST request to /OA_HTML/ibytransmit.
3. Vulnerability mechanism: The flaw (CVE-2026-46817) is caused by improper privilege management (CWE-269), improper authentication (CWE-287), and missing authentication for a critical function. The exploit calls an internal Oracle Java function directly, redirecting it to read an arbitrary file from the server.
4. Observed payload: In the decoy-observed activity, the exploit read /etc/passwd from the server filesystem — a targeted proof-of-concept, not broad scanning.
5. Potential impact escalation: The same file-read technique could be redirected to read more sensitive files, including: - Configuration files containing database credentials - Encryption keys - Payment processor API keys
6. Observed scope: Defused characterised the activity as "a single source running an unauthenticated file-read against the Payments component: a targeted proof-of-concept, not broad scanning." This was observed on 27 June 2026.

Discrepancy note: The GitHub Security Advisory (GHSA-2f6j-3xh8-jcv7) for the Oracle Payments File Transmission component lists CVSS 3.1 Base Score 7.4 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N and describes it as "Difficult to exploit." The VERIFIED REFERENCE DATA (NVD) records CVSS 9.8 CRITICAL with CWE-269 and CWE-287. The Help Net Security source and The Hacker News both cite 9.8. We use the verified 9.8 CRITICAL as authoritative. The discrepancy may reflect a difference between the GitHub advisory's assessment of the File Transmission component in isolation versus the NVD's assessment of the overall CVE. Both classifications can describe the same flaw — the higher score reflects the unauthenticated, easily exploitable nature confirmed by Oracle's own advisory language ("easily exploitable vulnerability").

Additional related advisories: GitHub also published related advisories for adjacent EBS components patched in the same cycle:

• Oracle Payroll (Internal Operations): GHSA-r6ff-f8fv-xc96 — CVSS 8.1, versions 12.2.3–12.2.15, low-privileged attacker via HTTP. Easily exploitable.
• Oracle Financials Common Modules (Common Components): GHSA-736v-m8w8-qf99 — CVSS 8.5, versions 12.2.3–12.2.15, low-privileged attacker via HTTP. Scope change noted — "attacks may significantly impact additional products." Easily exploitable.

These are distinct CVEs but were patched in the same Oracle May 2026 Critical Security Patch Update. Organisations should verify patch coverage for all three.

Attribution caveat: All exploitation reporting traces to a single source — Defused Cyber. No independent corroboration of in-the-wild exploitation has been identified from other threat intelligence vendors. Attribution of the attacker is not described; no named threat actor is identified. Treat as single-sourced; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

1. Identify all EBS instances: Inventory all Oracle EBS installations, specifically versions 12.2.3 through 12.2.15. Identify which have the Oracle Payments module enabled.
2. Check patch status: Determine whether the Oracle May 2026 Critical Security Patch Update has been applied. Any instance unpatched past 28 May 2026 is at risk.
3. Restrict network exposure: Immediately restrict EBS web interfaces to internal networks. No EBS instance should be internet-facing. Enforce at firewall/WAF level: - Block external HTTP/HTTPS access to EBS web tiers - If remote access is required, enforce VPN or zero-trust network access only
4. Hunt for exploitation: Search web server and application logs for suspicious POST requests to /OA_HTML/ibytransmit. Look for: - POST requests to /OA_HTML/ibytransmit from unexpected source IPs - Requests containing file-path references (e.g., /etc/passwd, configuration file paths) - Any requests to ibytransmit from unauthenticated sessions

P2 — Within 72 hours

1. Apply the patch: Apply Oracle's May 2026 Critical Security Patch Update to all affected EBS instances (12.2.3–12.2.15). This is the definitive remediation.
2. Patch adjacent components: Verify that the same patch update covers the Oracle Payroll (Internal Operations) and Oracle Financials Common Modules (Common Components) vulnerabilities identified in the related GitHub advisories.
3. If evidence of compromise is found: Perform a full forensic review of the affected host and: - Rotate all credentials stored on that host (database credentials, service accounts) - Rotate all encryption keys stored on or accessible from that host - Rotate all payment processor API keys - Review all data accessible to the Oracle Payments module for unauthorised access or modification
4. WAF rules: If a WAF sits in front of EBS, implement rules to block or alert on unauthenticated POST requests to /OA_HTML/ibytransmit.

P3 — Within 7 days

1. Architecture review: Given the pattern of repeated critical EBS vulnerabilities exploited in the last year, review whether any EBS installation requires internet-facing components at all. Document and justify any remaining external exposure.
2. EBS hardening: Review Oracle EBS hardening guidelines; ensure all non-essential modules and endpoints are disabled.
3. Monitoring: Implement ongoing log monitoring and alerting for requests to ibytransmit and other File Transmission endpoints.
4. Third-party risk review: Review contractual patching SLAs with Oracle and any managed-service provider operating EBS. Assess whether patch cycles can be accelerated for critical vulnerabilities.

5. Indicators of compromise

http_path  /OA_HTML/ibytransmit
http_method  POST
file_path  /etc/passwd
date  2026-06-27
ebs_version_range  12.2.3-12.2.15
component  Oracle Payments File Transmission

6. Detection

rule Oracle_EBS_CVE_2026_46817_Exploit_Artifacts {
    meta {
        author = "Adverse Trace"
        date = "2026-06-30"
        reference = "https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/"
        description = "Detects artifacts associated with exploitation of CVE-2026-46817 in Oracle EBS Payments File Transmission component"
    }
    strings:
        $endpoint1 = "/OA_HTML/ibytransmit" ascii
        $endpoint2 = "ibytransmit" ascii
        $filepath1 = "/etc/passwd" ascii
        $component1 = "File Transmission" ascii
        $component2 = "Oracle Payments" ascii
    condition:
        2 of them
}

title: Detect Suspicious POST Requests to Oracle EBS ibytransmit Endpoint
id: AT-2026-06-30-208-sigma-1
status: experimental
description: Detects POST requests to /OA_HTML/ibytransmit which may indicate exploitation of CVE-2026-46817 in Oracle EBS Payments
references:

  - https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/
author: Adverse Trace
date: 2026/06/30
logsource:
    product: webserver
    service: httpd
detection:
    selection:
        c-uri: "/OA_HTML/ibytransmit*"
        cs-method: "POST"
    condition: selection
falsepositives:

    - Legitimate Oracle Payments File Transmission operations (verify source IP and authentication status)
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• Help Net Security — "Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)" — https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/ — 2026-06-30
• The Hacker News — "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild" — https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html — 2026-06
• BleepingComputer — "Hackers now exploit critical Oracle E-Business flaw in attacks" — https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/ — 2026-06
• SecurityWeek — "Exploitation of Recent Oracle E-Business Suite Vulnerability Begins" — https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/ — 2026-06
• GitHub Security Advisories — "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission)" — https://github.com/advisories/GHSA-2f6j-3xh8-jcv7 — 2026
• GitHub Security Advisories — "Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations)" — https://github.com/advisories/GHSA-r6ff-f8fv-xc96 — 2026
• GitHub Security Advisories — "Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components)" — https://github.com/advisories/GHSA-736v-m8w8-qf99 — 2026

8. Adverse Trace position

Severity assessment: CVE-2026-46817 is CVSS 9.8 CRITICAL (verified via NVD), NOT in CISA KEV, EPSS 1%. The low EPSS percentile is inconsistent with the active exploitation reported by Defused and may reflect the recency of the flaw and the niche deployment base of Oracle EBS. The vulnerability is real, easily exploitable per Oracle's own assessment, and permits unauthenticated remote file-read on payment-processing infrastructure — the risk to EMEA financial services is high. The CVSS discrepancy between NVD (9.8) and the GitHub advisory (7.4) is noted; we assess the NVD score as authoritative but note that both scores describe the same underlying flaw with different exploitability assumptions.

Client-impact assessment: EMEA financial services running Oracle EBS 12.2.3–12.2.15 with the Payments module are directly impacted. Any unpatched, internet-facing instance should be treated as potentially compromised. The exposure surface extends beyond /etc/passwd to database credentials, encryption keys, and payment processor API keys — all of which are critical assets in a financial services context. The DORA, NIS2, and UK NIS regulatory frameworks are engaged (see §2).

Confidence caveat: All exploitation reporting is single-sourced to Defused Cyber. No independent threat intelligence vendor has corroborated the in-the-wild exploitation claim. Attribution of the attacker is not described; no named threat actor is identified and no MITRE ATT&CK profile exists for "Defused." We assess the technical detail as credible and consistent with the vulnerability description, but clients should verify before enforcement and treat the exploitation claim as probable but unconfirmed.

What we will do next: Adverse Trace will monitor for independent corroboration of exploitation, any public proof-of-concept release, additional IOCs (source IPs, user-agent strings, payload variants), and any CISA KEV addition. We will issue an updated advisory if the threat picture changes materially.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.