Reported by 5 outlets
Oracle E-Business Suite Critical Flaw (CVE-2026-46817) Now Exploited — CVSS 9.8 Unauthenticated HTTP Takeover
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.60 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-46817 is a CVSS 9.8 unauthenticated remote takeover in the File Transmission component of Oracle Payments within Oracle E-Business Suite, affecting versions 12.2.3 through 12.2.15. The vulnerability was patched in Oracle's May 28, 2026 Critical Security Patch Update, yet Defused Cyber captured the first in-the-wild exploitation on June 27, 2026, roughly six weeks after the fix was available and before any public proof-of-concept appeared. The attacker delivered a crafted XML POST to /OA_HTML/ targeting the Payments transmission endpoint, performing unauthenticated file reads rather than broad scanning. A companion flaw, CVE-2026-46818, uses HTTPS with a lower CVSS of 7.4, meaning organizations that block only HTTP at the perimeter remain exposed on the encrypted path.
The exposure is concentrated, not diffuse. Shadowserver tracks approximately 950 Oracle EBS instances online, more than half in the United States, and the update event records Defused observing a single EU source IP hitting six honeypot instances in a two-hour window characterized as reconnaissance and weaponization testing. That pattern mirrors the Cl0p/FIN11 campaign against the prior Oracle EBS zero-day CVE-2025-61882, which used the same unauthenticated HTTP file-transmission path (CVSS 9.8) to breach over 100 organizations including Michelin and Korean Air. The recurrence of an identical profile, combined with exploitation before any public PoC existed, strongly suggests attackers reverse-engineered the May 2026 patch rather than independently discovering the weakness. For defenders, the implication is that any internet-facing Oracle Payments instance is a high-value target selected deliberately, not caught by indiscriminate scanning, and the attack surface spans over a decade of 12.2.x deployments.
Apply the Oracle May 2026 CPU immediately; there is no fixed version beyond the patch release, so upgrade to the corrected build for your branch rather than expecting an out-of-band hotfix. Restrict Oracle EBS from the public internet wherever business-partner connectivity allows, and verify that HTTPS is not left exposed as a backdoor given CVE-2026-46818. Hunt for POST requests to /OA_HTML/ carrying DeliveryRequest XML with a FULL_FILE_PATH parameter, unexpected connections to Oracle Payments File Transmission endpoints, and child processes spawned by EBS application servers after archive extraction. The events mention no public indicators of compromise, so behavioral correlation against application server logs and reverse-proxy traffic for June 27 onward is the only viable detection path.
Watch for two shifts. First, confirmation that the observed single-source exploitation expands to multiple IPs or broad scanning, which would signal a weaponized public exploit and compress remediation timelines from days to hours. Second, a CISA Known Exploited Vulnerabilities listing for CVE-2026-46817, which would trigger binding federal patch deadlines and likely accelerate private-sector response. The absence of either as of July 2, 2026 is not reassurance; the Defused telemetry and the historical Cl0p precedent are sufficient grounds for immediate action.
Timeline
-
original reporting
Oracle E-Business Suite Critical Flaw (CVE-2026-46817) Now Exploited — CVSS 9.8 Unauthenticated HTTP Takeover
bleepingcomputer.com · 106d ago · June 30th, 2026
Threat intelligence firm Defused has confirmed active exploitation of CVE-2026-46817, a critical unauthenticated vulnerability in the Oracle E-Business Suite (EBS) File Transmission component of Oracle Payments, over the weekend.
The flaw (CVSS 9.8) enables unauthenticated attackers with HTTP network access to take over vulnerable systems through low-complexity attacks. Oracle released patches with its May 2026 Critical Security Patch Update. Defused observed exploitation with no public PoC available, suggesting attackers reverse-engineered the patch. Shadowserver tracks over 450 Oracle EBS instances exposed online, nearly 200 in the United States.
Context: This is a separate vulnerability from the PeopleSoft CVE-2026-35273 exploited by ShinyHunters — the EBS flaw affects a different Oracle product family and represents a fresh attack surface for organizations running Oracle financial applications.
Recommended action: Apply the Oracle May 2026 CPU immediately. Verify EBS instances are not internet-facing where possible.
-
update from oracle.com
Oracle Critical Security Patch Update Advisory - May 2026
oracle.com · 139d ago · May 28th, 2026
The advisory notes that attackers have previously succeeded against unpatched systems and urges immediate application of available fixes. Published May 28, 2026.
-
update from zeropath.com
Oracle E-Business Suite CVE-2026-46817: Brief Summary of a Critical Unauthenticated Payments Takeover
zeropath.com · 139d ago · May 28th, 2026
ZeroPath published an AI-generated analysis on May 28, 2026 identifying CVE-2026-46817 as a CVSS 9.8 unauthenticated vulnerability in Oracle EBS Payments File Transmission, affecting versions 12.2.3-12.2.15. The analysis notes the same attack profile as the prior Cl0p/FIN11 zero-day CVE-2025-61882 and warns that no public proof-of-concept existed at publication. It references the Oracle May 2026 CSPU as the remediation source.
-
update from tenable.com
CVE-2026-46817 — Tenable CVE Summary
tenable.com · 139d ago · May 28th, 2026
It references the Oracle May 2026 CSPU advisory and later notes CISA KEV listing and additional exploitation coverage as of July.
-
update from defusedcyber.com
CVE-2026-46817 — active exploitation observed
defusedcyber.com · 110d ago · June 26th, 2026
Defused Cyber reported active exploitation of CVE-2026-46817 observed on June 27, 2026, with six unauthenticated file-read attempts against Oracle EBS decoys from a single EU source IP. The attacks happened roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed. The attacker used a POST to /OA_HTML/ with a crafted XML DeliveryRequest payload targeting the Payments File Transmission component. No broad scanning was observed; the activity was characterized as targeted proof-of-concept testing.
-
update from bleepingcomputer.com
Oracle EBS CVE-2026-46817 Attack Surface Expands — 950 Exposed Instances, Reconnaissance Phase Underway
bleepingcomputer.com · 104d ago · July 2nd, 2026
Shadowserver reports tracking approximately 950 Oracle E-Business Suite instances exposed online — more than half in the United States — as active exploitation of CVE-2026-46817 (CVSS 9.8) continues. Defused observed a single IP address exploiting the flaw across six honeypot instances during a two-hour window on Saturday, characterized as "reconnaissance and weaponization testing" rather than a targeted campaign.