NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Oracle E-Business Suite Payments takeover flaw CVE-2026-46817 used in attacks; patches available

Attackers are exploiting CVE-2026-46817 in Oracle E-Business Suite’s Payments module. It affects unpatched versions 12.2.3–12.2.15 and allows takeover without logging in. Ask your IT team to apply Oracle’s May 2026 security patches and check for compromise.

What to do

Nothing to update on your family’s personal devices. If your business or family office runs Oracle E-Business Suite, ask its IT provider to apply the May 2026 patches specified in Oracle Support Note KA923 and investigate any exposure before patching.

What’s happening

CVE-2026-46817 affects File Transmission in Oracle Payments, part of Oracle E-Business Suite. Oracle says an attacker who can reach the service over HTTP can take over Payments without credentials or user interaction. The supported versions affected are 12.2.3 through 12.2.15. Oracle released patches on 28 May; its public advisory directs administrators to My Oracle Support Note KA923 for the patches required by their installation, rather than naming one fixed release number. Defused observed file-reading attacks against decoy systems on 27 June, and CISA listed the flaw as exploited on 15 July. As of 3 November, the sources checked establish patch availability and exploitation, but do not establish how many customer organisations were compromised or whether the attacks have stopped. Unsupported releases require an upgrade to receive security fixes.

What
Flaw
Affects
Oracle E-Business Suite — Oracle Payments
Affected
Oracle Payments (Oracle E-Business Suite), File Transmission component, versions 12.2.3–12.2.15
Fixed in
Oracle E-Business Suite May 2026 Critical Security Patch Update; installation-specific patches listed in My Oracle Support Note KA923
CVE
CVE-2026-46817
Since
15 July 2026
Closed
15 July 2026

Timeline

  1. CISA added

    CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalogue. BleepingComputer reported that US federal agencies were required to remediate affected systems by 18 July.

  2. Update

    Defused recorded six attempts from one source to read files without logging in on its Oracle E-Business Suite decoy systems. This establishes attack activity, but does not establish a breach of a customer organisation.

  3. New fixFixed

    Oracle disclosed CVE-2026-46817 and released patches in its May Critical Security Patch Update. Its affected-version list covers Oracle Payments 12.2.3 through 12.2.15.

Sources

  1. Oracle Critical Security Patch Update Advisory — May 2026Oracle · 28 May 2026
  2. Text Form of Oracle Critical Security Patch Update — May 2026 Risk MatricesOracle · 28 May 2026
  3. CVE-2026-46817 — active exploitation observedDefused
  4. Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)Help Net Security · 30 June 2026
  5. CISA orders feds to patch actively exploited Oracle flaw by SaturdayBleepingComputer · 16 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS