CVE-2026-46817: Oracle E-Business Suite Payments Unauth Remote Takeover, CISA Confirms In-the-Wild Use

Oracle Payments in Oracle E-Business Suite has a critical privilege-management flaw. Unauthenticated remote attackers can fully control the Payments module over HTTP. CVSS 9.8. CISA listed it in KEV.

On 15 July 2026, CISA added CVE-2026-46817 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. The flaw hits the Oracle Payments component in Oracle E-Business Suite and lets unauthenticated remote attackers fully control the Payments module.

Incident Overview

CVE-2026-46817 exists in the Oracle Payments File Transmission component of Oracle E-Business Suite 12.2.3 through 12.2.15. It is improper privilege management (CWE-269). Missing authentication checks let unauthenticated attackers fully take over the Oracle Payments module via HTTP.

Oracle fixed it in the May 2026 Critical Patch Update (CPU). U.S. federal agencies face a mandatory remediation deadline of 18 July. CISA listing confirms in-the-wild use.

Technical Details

Vulnerability Characteristics

• CVE: CVE-2026-46817
• Component: Oracle Payments File Transmission
• Affected versions: Oracle E-Business Suite 12.2.3 – 12.2.15
• Attack vector: Network
• Attack complexity: Low
• Privileges required: None
• User interaction: None

CVSS Score

Version Score Severity Vector

CVSS 3.1 9.8 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This score means extreme practical threat: no privileges, no user interaction, full confidentiality, integrity, and availability impact.

Impact Assessment

Per Armis, EPSS is 13.3% (96th percentile)—very high exploitation probability in the next 30 days. One-day EPSS rose 12.26%; exploitation interest keeps climbing.

Oracle E-Business Suite is widely deployed in manufacturing, retail, finance, public administration, and other sectors. After compromising Payments, attackers may:

• Access and tamper with payment configuration and sensitive data
• Execute unauthorized financial transactions
• Pivot laterally into the enterprise network
• Plant persistent backdoors

Remediation

Official Patch

Oracle shipped the fix in the May 2026 Critical Patch Update. Affected customers should get the specific patch number from Oracle Support and apply it with the AD (Applications DBA) patching tool via an online patching cycle:

`adop phase=apply patches=<patch-number>`

Temporary Mitigation

If you cannot patch immediately:

• Restrict unauthenticated access to EBS application-tier HTTP ports at the network boundary
• Put strict WAF access-control rules on Oracle Payments interfaces
• Review and restrict source IPs that can reach the Payments module

Detection

• Monitor Oracle Payments interfaces for anomalous HTTP requests
• Check for unauthorized admin account creation or privilege changes
• Review unauthorized modifications to Payments configuration files

References

• Oracle May 2026 Critical Patch Update
• CISA KEV catalog
• NVD CVE-2026-46817 details
• Armis vulnerability analysis