Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released

1. Executive summary

A critical vulnerability in Oracle E-Business Suite (EBS) Payments — CVE-2026-46817 — is being actively exploited in the wild following Oracle's May 2026 Critical Patch Update. Researchers at Defused observed the first known exploitation on 27 June 2026, approximately six weeks after the patch shipped and before any public proof-of-concept existed. The flaw affects EBS releases 12.2.3 through 12.2.15 and enables unauthenticated attackers to read arbitrary files from vulnerable servers. The Shadowserver Foundation reports approximately 950 EBS instances exposed to the public internet. EMEA financial services running internet-facing EBS instances are at immediate risk of sensitive data exfiltration.

Severity note: The VERIFIED REFERENCE DATA records CVSS as "unknown" for CVE-2026-46817 and the CVE is NOT in CISA KEV. Multiple source outlets (The Hacker News, The Register) cite a CVSS score of 9.8, while GitHub Security Advisories (GHSA-2f6j-3xh8-jcv7) records CVSS 3.1 Base Score 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). This discrepancy is noted below; the authoritative verified value is "unknown" and we do not re-assess.

Attribution note: The source material references two named actors — "ShinyHunters" and "Clop" — in the context of broader Oracle ERP targeting. Neither actor has a MITRE ATT&CK profile in the VERIFIED REFERENCE DATA. Attribution for the current CVE-2026-46817 exploitation is unconfirmed; the named actors are referenced for historical context only.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17: ICT-related incident management process	Active exploitation of a critical vulnerability in Oracle EBS Payments, a core financial application component, observed in the wild	Financial entities running EBS must have an incident management process that can detect, triage, and respond to exploitation of this component. This item is a live threat trigger, not a theoretical risk.
DORA Art. 18: classification of ICT-related incidents and cyber threats	The vulnerability enables unauthenticated arbitrary file read from production EBS servers; severity is contested (9.8 vs 7.4) and exploitation is confirmed	Entities must classify this as a high-severity cyber threat given confirmed in-the-wild exploitation and the sensitivity of data accessible via the Payments module.
DORA Art. 19: reporting of major ICT-related incidents to competent authorities	If exploitation is confirmed on a firm's own EBS instance, the incident may meet the threshold for major ICT-related incident reporting	Security teams should pre-classify this CVE's exploitation as a candidate major incident and ensure reporting workflows are ready.
DORA Art. 28: ICT third-party risk — general principles	Oracle EBS is an ICT third-party service for many financial entities; the vulnerability is in a vendor-supplied component (Oracle Payments File Transmission)	Entities should verify that Oracle patch SLAs and vulnerability management processes are current and that third-party risk assessments cover this CVE.
NIS2 Art. 21(2)(d): supply chain security measures	Oracle EBS is enterprise software supplied by a third-party vendor; the flaw resides in the vendor's Payments module	NIS2-covered entities must ensure supply chain security measures include tracking and patching vendor vulnerabilities of this severity class.
NIS2 Art. 23: incident reporting obligations	Active exploitation of a critical vulnerability in a core business system may trigger mandatory incident reporting	If exploitation is detected on a covered entity's systems, NIS2 incident reporting obligations may be engaged.
UK NIS 2018: UK Network and Information Systems Regulations — OES/RDSP duties	EBS instances exposed to the public internet may constitute network and information systems under OES/RDSP scope	UK operators should assess whether internet-facing EBS instances fall within OES/RDSP duties and ensure vulnerability remediation timelines are met.

3. Technical analysis & attack chain

Vulnerable component

Product: Oracle E-Business Suite (EBS)
Module: Oracle Payments — File Transmission component
Affected versions: 12.2.3 through 12.2.15
Patch: Oracle May 2026 Critical Patch Update (CPU)
CVE: CVE-2026-46817
Access vector: Network access via HTTPS; unauthenticated
CVSS (verified): Unknown — see discrepancy note below

CVSS discrepancy

The VERIFIED REFERENCE DATA records CVSS as "unknown." Source material provides two conflicting scores:

The Hacker News / The Register: CVSS 9.8 (critical)
GitHub Security Advisories (GHSA-2f6j-3xh8-jcv7): CVSS 3.1 Base Score 7.4 (high) — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N — described as "Difficult to exploit"

The GHSA advisory also describes the vulnerability as "Difficult to exploit," while Defused's honeypots recorded what appeared to be a working exploit. Both the "difficult to exploit" classification and the observed working exploit can coexist — the difficulty rating reflects the exploit's prerequisites, not whether exploitation is possible. The verified CVSS remains "unknown"; we do not re-assess.

Attack chain (confirmed steps)

Reconnaissance / target selection: The attacker identified internet-facing Oracle EBS instances. Shadowserver reports approximately 950 EBS instances exposed to the public internet, the majority in the US. The exploitation did not resemble indiscriminate internet scanning — Defused's honeypots recorded only six attempts from a single source, suggesting targeted validation rather than mass exploitation.
Initial access: The attacker sent HTTPS requests to the Oracle Payments File Transmission component on EBS releases 12.2.3–12.2.15. No authentication was required (the vulnerability allows unauthenticated access).
Expitation mechanism: The vulnerability is characterised as an improper privilege management and authentication flaw in Oracle Payments (per The Hacker News). The Register describes it as allowing unauthenticated attackers to read arbitrary files from vulnerable servers. The GitHub advisory describes the impact as "unauthorized creation, deletion or modification access to critical data or all Oracle Payments accessible data as well as unauthorized access to critical data or complete access to all Oracle Payments accessible data." The primary observed activity was file retrieval — the requests sought to retrieve sensitive files from the target system.
Data access / exfiltration: The exploitation attempts targeted retrieval of sensitive files from the EBS server. The scale was limited (six attempts from a single source), consistent with testing or validation of the exploit technique rather than mass data theft.
Timing / exploit origin: Exploitation began on 27 June 2026 — approximately six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed. This indicates the attacker either reverse-engineered Oracle's patch or obtained a private exploit. This is a single-sourced finding from Defused; corroborated by Help Net Security and BleepingComputer reporting the same Defused claim, but no independent confirmation of the timing exists.

Unconfirmed / contextual claims

"ShinyHunters" are referenced in The Register as having exploited a separate PeopleSoft zero-day earlier in the month, claiming compromise of 100+ organisations and theft of HR/payroll data. This is a separate incident. No MITRE ATT&CK profile exists for "ShinyHunters" in the verified data; attribution is unconfirmed.
"Clop" are referenced as having conducted a lengthy campaign against Oracle EBS customers, disclosed the previous year. This is historical context. No MITRE ATT&CK profile exists for "Clop" in the verified data; attribution is unconfirmed.
Neither actor is directly attributed to the current CVE-2026-46817 exploitation. The connection is thematic (Oracle ERP targeting) not operational.

Confidence caveat

The exploitation timing (27 June 2026), the six-attempt count, and the single-source attribution are single-sourced to Defused. While Help Net Security, BleepingComputer, The Hacker News, and SecurityWeek all report the Defused findings, none provide independent corroboration of the honeypot data. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

Identify all EBS instances in the estate running versions 12.2.3 through 12.2.15. Inventory should cover production, DR, UAT, and any internet-facing instances.
Block external access to Oracle Payments File Transmission endpoints at the network layer (WAF, reverse proxy, firewall). If the Payments module does not require internet exposure, restrict access to internal/trusted networks only.
Check for the May 2026 CPU. If it has NOT been applied, treat the instance as vulnerable and exposed. Priorise patching.
Review EBS access logs for unauthenticated HTTPS requests to the Payments File Transmission component. Look for file-retrieval patterns (requests attempting to read arbitrary file paths) originating from unexpected source IPs, especially in the June 27–July 2 window.

P2 — Within 72 hours

Apply the Oracle May 2026 Critical Patch Update to all EBS instances running 12.2.3–12.2.15. This is the vendor fix for CVE-2026-46817.
Verify patch application by confirming the EBS version is no longer in the affected range or that the specific Payments File Transmission component has been updated.
Deploy WAF rules to block unauthenticated requests to the Payments File Transmission component. If a WAF is not in front of EBS, implement at the reverse proxy or load balancer layer.
Audit internet exposure. Cross-reference the estate against Shadowserver's finding of ~950 exposed instances. If any EBS instance is internet-facing without explicit business justification, remove it from public exposure.

P3 — Within 7 days

Conduct a full vulnerability scan of all EBS instances to confirm no other unpatched Oracle CPU items remain.
Review and update EBS hardening per Oracle best practices — ensure TLS is current, default credentials are rotated, and the Payments module is restricted to authorised internal networks.
Update incident response playbooks to include detection and response for Oracle Payments module exploitation, including file-read exfiltration patterns.
Engage Oracle support if any instances cannot be patched within the window — seek a mitigation or workaround if the CPU cannot be applied immediately.

5. Indicators of compromise

No specific IOCs (IP addresses, file hashes, domains, user agents, or request strings) are present in the source material. The sources describe exploitation behaviour (unauthenticated HTTPS requests to Oracle Payments File Transmission, file-retrieval patterns, six attempts from a single source) but do not provide concrete indicator values.

No indicators of compromise available in the source material.

6. Detection

The sources do not provide concrete IOCs (IPs, hashes, domains, user agents, or request strings). However, the sources do provide specific technical artefacts that enable behavioural and log-based detection:

Component name: Oracle Payments File Transmission
Affected versions: 12.2.3 through 12.2.15
Access pattern: Unauthenticated HTTPS requests to the Payments File Transmission component
Behaviour: File retrieval / arbitrary file read from the target system
Timing: Exploitation observed from 27 June 2026 onward

YARA rule

No file-based indicators are available. A YARA rule is not applicable for this network/application-layer vulnerability.

Sigma rule

title: Detect Unauthenticated Access to Oracle EBS Payments File Transmission
id: 6f8a-2c3d-4e5f-8a9b-at20260702227
status: experimental
description: >
  Detects unauthenticated HTTPS access to the Oracle E-Business Suite Payments
  File Transmission component, consistent with exploitation of CVE-2026-46817.
  Based on Defused observations of in-the-wild exploitation from 27 June 2026.
references:

  - https://www.theregister.com/cyber-crime/2026/07/02/oracle-e-business-suite-was-under-attack-via-critical-flaw-before-the-public-exploit-code-was-even-released/5265710
  - https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/
  - https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html
author: Adverse Trace
date: 2026/07/02
logsource:
  product: oracle
  service: ebs
  component: payments
detection:
  selection:

    - uri|contains:
        - "Payments"
        - "FileTransmission"
        - "fileTransmission"
    - http_method:
        - GET
        - POST
    - user_agent|contains:
        - ""
    - authenticated: false
  condition: selection
  note: >
    This rule targets web server / reverse proxy / WAF logs in front of Oracle EBS.
    Adjust URI matching to the specific EBS deployment path. The vulnerability allows
    unauthenticated access, so requests to the Payments File Transmission component
    without a valid session token are suspicious. Correlate with file-read patterns
    in request parameters.
falsepositives:

  - Legitimate unauthenticated health checks or load balancer probes to the Payments
    component (should be rare and from known internal IPs)
level: high

Detection guidance for defenders

Web server / reverse proxy logs: Search for unauthenticated (no session cookie / no valid Oracle EBS session) HTTPS requests to URIs containing "Payments" or "FileTransmission" on EBS 12.2.3–12.2.15 instances.
File-read patterns: Look for request parameters that reference file paths (absolute paths, ../ traversal sequences, or references to sensitive system files) directed at the Payments File Transmission endpoint.
Source IP correlation: The observed activity came from a single source with six attempts. Low-volume, targeted requests to this component from unfamiliar IPs are high-signal.
Timing window: Focus initial hunts on 27 June 2026 onward.

CVE assessment

1 referenced CVE

CVE	CVSS	Exploited	EPSS	Summary
CVE-2026-46817	—	—	—

7. Sources

The Register — "Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released" — https://www.theregister.com/cyber-crime/2026/07/02/oracle-e-business-suite-was-under-attack-via-critical-flaw-before-the-public-exploit-code-was-even-released/5265710 — 2026-07-02
BleepingComputer — "Hackers now exploit critical Oracle E-Business flaw in attacks" — https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/ — 2026-06/07
Help Net Security — "Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)" — https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/ — 2026-06-30
The Hacker News — "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild" — https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html — 2026-06
BleepingComputer — "Over 900 Oracle E-Business instances exposed to ongoing attacks" — https://www.bleepingcomputer.com/news/security/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks/ — 2026-06/07
GitHub Security Advisories — "Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission)" — https://github.com/advisories/GHSA-2f6j-3xh8-jcv7 — 2026
SecurityWeek — "Exploitation of Recent Oracle E-Business Suite Vulnerability Begins" — https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/ — 2026

8. Adverse Trace position

Severity assessment: The verified CVSS for CVE-2026-46817 is "unknown" and the CVE is not in CISA KEV. Source-reported scores range from 7.4 (GHSA, high) to 9.8 (The Hacker News / The Register, critical). We do not re-assess; we treat this as a high-to-critical vulnerability given confirmed in-the-wild exploitation. The vulnerability enables unauthenticated arbitrary file read from EBS servers via the Payments File Transmission component, affecting versions 12.2.3–12.2.15. The patch has been available since Oracle's May 2026 CPU.

Client-impact assessment: EMEA financial services running internet-facing Oracle EBS instances in the affected version range are at immediate risk. The Payments module processes financial transaction data — file exfiltration from this component could expose payment configuration, transaction data, credentials, or integration keys. The targeted, low-volume nature of the observed exploitation (six attempts from a single source) suggests an actor validating capability rather than mass-scaming, which may precede broader campaigns. Clients should treat this as an active, not theoretical, threat.

Attribution: The named actors (ShinyHunters, Clop) are unconfirmed for this specific exploitation. They are referenced for historical context of Oracle ERP targeting. No MITRE ATT&CK profiles exist for either in the verified data.

Confidence caveat: The exploitation timing, attempt count, and single-source attribution rest on Defused's honeypot data. This is single-sourced; verify before enforcement.

What we will do next: Adverse Trace will monitor for (a) public PoC release, which would lower the barrier to broader exploitation, (b) any expansion of the attack beyond the observed low-volume validation pattern, (c) independent corroboration of the Defused findings, and (d) any CISA KEV addition or CVSS confirmation from NVD. We will issue an updated advisory if the threat posture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.