CVE-2026-46817

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-46817 9.8

Oracle · E-Business Suite · Added 2026-07-15 · Published 2026-05-28

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityOracle E-Business Suite Improper Privilege Management Vulnerability

VendorOracle

ProductE-Business Suite

Date added2026-07-15

Due date2026-07-18

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-269 CWE-287 CWE-306

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.

NVD: Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-08-25 21:43 UTC

Wall time0.5s

Searches4

Component defaultunknown

Sources https://www.oracle.com/security-alerts/cve_2026_46817.html
https://github.com/0xBlackash/CVE-2026-46817
https://socradar.io/blog/cve-2026-46817-oracle-payments-takeover/
https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/
https://www.theregister.com/cyber-crime/2026/07/02/oracle-e-business-suite-was-under-attack-via-critical-flaw-before-the-public-exploit-code-was-even-released/
https://cve.tools/blog/cve-2026-46817-oracle-ebs-payments-file-read-breakdown
https://techscurrent.com/2026/06/oracle-e-business-suite-cve-2026-46817-payments-exploit/

Hunting hypothesis agent

Hunt for unauthenticated HTTP requests to /ibytransmit, /OA_HTML/IbyTransmit, or /pls/ib on E-Business Suite instances returning 200/302, then correlate with Oracle Payments file read activity in WAF or web access logs.

Research details

ComponentOracle Payments (iPayment) File Transmission component — improper authentication/authorization on the file upload/transfer endpoint allows unauthenticated file read and potential RCE

PreconditionsNetwork access (HTTP) to an Oracle E-Business Suite instance running versions 12.2.3 through 12.2.15 with Oracle Payments module enabled; no authentication required; no user interaction needed. Approximately 950 internet-facing EBS instances were tracked by Shadowserver at disclosure. agent

DeliveryNetwork (HTTP); unauthenticated requests to the Oracle Payments File Transmission endpoint exploit missing authentication and improper privilege management, enabling unauthorized file access and potential full application compromise.

Public PoCyes

PoC URLs https://github.com/0xBlackash/CVE-2026-46817 Third-party repos; verify before use.

Advisoryhttps://www.oracle.com/security-alerts/cve_2026_46817.html

Exploit notesThe GitHub repo 0xBlackash/CVE-2026-46817 contains a detection checker (CVE-2026-46817.py) that probes six Oracle Payments endpoints (/ibytransmit, /OA_HTML/IbyTransmit, /oracle/payments, /OA_HTML/jsp/iby, /pls/ib, /ebs/payments) for unauthenticated access and EBS version string leakage. The README describes a critical unauthenticated RCE via the File Transmission component; the published code is scanner-only but confirms the attack surface. The Register reports exploitation began before public exploit code was released, indicating prior attacker knowledge. PoC has 1 star, 1 fork. CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8).

SummaryOracle E-Business Suite versions 12.2.3 through 12.2.15 contain an improper privilege management vulnerability (CWE-269/CWE-287/CWE-306) in the Oracle Payments (iPayment) File Transmission component. The flaw combines missing authentication for a critical function with improper authentication and privilege management, allowing an unauthenticated remote attacker to compromise Oracle Payments via HTTP without user interaction. A public Python exploit exists on GitHub demonstrating unauthenticated file read and potential RCE. The vulnerability is actively exploited in the wild; The Register reports exploitation began before public exploit code surfaced, indicating prior attacker knowledge.

Tia coverage

First reported2026-06-30

First exploit report2026-06-30

Exploit report → KEV15 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

oracle-e-business-suite-critical-flaw-cve-2026-46817-now-exploit

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.