Loading story…
Attackers are actively exploiting CVE-2026-46817, a critical 9.8 severity flaw in the Oracle Payments File Transmission component of Oracle E-Business Suite. The vulnerability affects EBS versions 12.2.3 through 12.2.15 and allows unauthenticated attackers with HTTP access to compromise confidentiality, integrity, and availability on vulnerable systems. Oracle addressed the issue in its May 2026 Critical Patch Update and urged customers to apply fixes immediately.
Security researchers observed in-the-wild exploitation against Oracle EBS honeypots, including crafted POST requests to the /OA_HTML/ibytransmit endpoint with XML payloads abusing the CODEX_PULL transmission scheme. The activity reportedly attempted to read /etc/passwd, pointing to a local file read or path traversal exploitation chain, and occurred despite no known public proof-of-concept, suggesting private exploit tooling. Internet scanning data indicates more than 450 exposed Oracle EBS instances remain reachable, with attack activity recorded across multiple regions, including North America, Europe, and Asia.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
BleepingComputer reported that Shadowserver was tracking roughly 950 internet-exposed Oracle E-Business Suite instances amid ongoing exploitation of CVE-2026-46817. The report said it was unclear how many of those exposed systems remained vulnerable to the flaw.
Shadowserver telemetry recorded 456 attack hits on June 28, 2026, targeting internet-exposed Oracle E-Business Suite instances across multiple regions, with North America and Asia leading. Separate reporting also noted more than 450 exposed Oracle EBS instances being tracked, though patch status was unclear.
Defused observed active exploitation of CVE-2026-46817 against Oracle E-Business Suite honeypots during June 27-28, 2026. The activity included targeted POST requests to the /OA_HTML/ibytransmit endpoint with crafted XML payloads abusing the CODEX_PULL transmission scheme and attempting to read /etc/passwd.
Oracle fixed CVE-2026-46817, a critical vulnerability in the Oracle Payments File Transmission component of Oracle E-Business Suite, in its May 2026 Critical Patch Update. One reference explicitly dates this patch release to May 28, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcetheregister.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcedashboard.shadowserver.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions `12.2.3` through `12.2.15`, including **CVE-2026-46817** in the Oracle Payments File Transmission component and **CVE-2026-46933** in Oracle Applications Manager. **CVE-2026-46817**, rated `CVSS 9.8`, can be exploited by an unauthenticated remote attacker over HTTP via the `/OA_HTML/ibytransmit` endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while **CVE-2026-46933**, rated `CVSS 9.9`, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities. Security researchers reported that **CVE-2026-46817** is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read `/etc/passwd`, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Jul 17, 2026
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1,642 to 1,644, including **CVE-2026-46817**, a critical flaw in Oracle E-Business Suite Oracle Payments, and **CVE-2023-4346**, which affects KNX Protocol Connection Authorization Option 1. The Oracle issue affects Oracle Payments File Transmission in E-Business Suite versions `12.2.3` through `12.2.15` and is being actively exploited, while the KNX flaw can let an attacker purge devices that lack additional security options and set a BCU key that locks the device. The Oracle vulnerability can be exploited remotely over HTTP without authentication or user interaction through the `/OA_HTML/ibytransmit` endpoint using crafted XML `DeliveryRequest` payloads, allowing arbitrary file reads and possible exposure of credentials, encryption keys, payment processor API keys, and sensitive ERP or financial data. Oracle released fixes in its May 2026 Critical Patch Update and a supplementary update in June, and CISA directed organizations to apply vendor mitigations and follow **BOD 26-04** deadlines; security researchers warned that internet-facing, unpatched Oracle E-Business Suite instances should be treated as potentially compromised.
Jul 17, 2026
Oracle E-Business Suite (EBS) was found to contain a critical zero-day vulnerability, tracked as CVE-2025-61884 and CVE-2025-61882, which allowed unauthenticated remote code execution and was actively exploited by threat actors, including the Clop ransomware group. The vulnerability, present in EBS versions 12.2.3 through 12.2.14, enabled attackers to access sensitive resources without authentication by exploiting a pre-authentication Server-Side Request Forgery (SSRF) flaw. Oracle released an out-of-band security update to address the issue, but did so without publicly acknowledging that the flaw was being actively exploited or that a proof-of-concept exploit had been leaked by the ShinyHunters extortion group. Security researchers and customers confirmed that the patch addressed the SSRF vulnerability used in the attacks. The exploit chain was complex, involving an unauthenticated HTTP POST to a specific servlet, manipulation of return_url parameters to trigger SSRF, CRLF/header injection, HTTP connection reuse, and ultimately the delivery of a malicious XSL stylesheet. This XSLT payload, containing embedded Java code, was processed by the server, leading to arbitrary code execution and the potential for attackers to spawn reverse shells. The Clop ransomware group sent extortion emails to Oracle EBS customers, claiming to have stolen sensitive data by exploiting this flaw, and confirmed their involvement in the campaign. The attack campaign was detected by Mandiant and Google, who observed that multiple threat actors were leveraging the vulnerability for data theft and extortion. The exploit chain demonstrated the risk of chaining multiple weaknesses in enterprise software to achieve full remote code execution. Security vendors, such as Imperva, responded by confirming protection for their customers against this exploit. The incident highlighted Oracle's lack of transparency regarding active exploitation and the public availability of exploit code. The technical details of the exploit, including SSRF, CRLF injection, and XSLT-based code execution, underscored the sophistication of the attack. The vulnerability's exploitation in the wild emphasized the importance of rapid patching and monitoring for signs of compromise in Oracle EBS environments. The campaign also illustrated the ongoing threat posed by ransomware and extortion groups targeting critical business applications. Organizations using Oracle EBS were urged to apply the security update immediately and review their systems for indicators of compromise. The incident raised concerns about the security of widely used enterprise resource planning (ERP) platforms and the need for proactive vulnerability management.
Jun 29, 2026