Loading story…
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions 12.2.3 through 12.2.15, including CVE-2026-46817 in the Oracle Payments File Transmission component and CVE-2026-46933 in Oracle Applications Manager. CVE-2026-46817, rated CVSS 9.8, can be exploited by an unauthenticated remote attacker over HTTP via the /OA_HTML/ibytransmit endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while CVE-2026-46933, rated CVSS 9.9, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities.
Security researchers reported that CVE-2026-46817 is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read /etc/passwd, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
The report says Shadowserver found about 950 Oracle E-Business Suite instances exposed to the internet, with many located in the United States. This significantly increased the known exposure baseline associated with CVE-2026-46817 compared with earlier reporting.
Shadowserver identified more than 450 internet-exposed Oracle E-Business Suite instances, increasing the potential risk from CVE-2026-46817. The exposed systems were noted as especially concerning for enterprise financial environments.
Defused observed active exploitation attempts against Oracle E-Business honeypots on June 27 and 28, 2026, targeting CVE-2026-46817. The activity included crafted XML payloads attempting to read /etc/passwd, indicating private exploit tooling was already in use before any public proof of concept was available.
The German Federal Office for Information Security warned about an Oracle E-Business Suite bug cluster that included CVE-2026-46933. The warning highlighted the severity of the issue, though no active exploitation was reported at that time.
Oracle released a patch for CVE-2026-46933, a critical Oracle Applications Manager vulnerability in Oracle E-Business Suite, in its June 2026 Critical Security Patch Update. The flaw affects versions 12.2.3 through 12.2.15 and can allow full compromise by a low-privileged attacker over HTTP.
The reference states that CVE-2026-46817 was published to the National Vulnerability Database on 2026-05-28. At that time, no CWE classification, proof-of-concept, or confirmed exploitation had been disclosed, according to the report.
Oracle fixed CVE-2026-46824, a critical Oracle E-Business Suite flaw in Oracle Universal Work Queue's Work Provider Site Level Administration component, in its May 2026 Critical Security Patch Update. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 and can allow low-privileged attackers to achieve complete application takeover.
Oracle fixed CVE-2026-46817, a critical Oracle E-Business Suite flaw in the File Transmission component of Oracle Payments, in its May 2026 Critical Security Patch Update. The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15.
The reference states that CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on 2026-07-15, noting active exploitation. This marks an official U.S. government acknowledgment of in-the-wild exploitation of the Oracle E-Business Suite flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcethreataft.com
Open sourcethreataft.com
Open sourceegfincirt-wpn.azurewebsites.net
Open sourcezeropath.com
Open sourcezeropath.com
Open sourcecve.circl.lu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-46817**, a critical `9.8` severity flaw in the Oracle Payments **File Transmission** component of **Oracle E-Business Suite**. The vulnerability affects EBS versions `12.2.3` through `12.2.15` and allows unauthenticated attackers with HTTP access to compromise confidentiality, integrity, and availability on vulnerable systems. Oracle addressed the issue in its May 2026 Critical Patch Update and urged customers to apply fixes immediately. Security researchers observed in-the-wild exploitation against Oracle EBS honeypots, including crafted `POST` requests to the `/OA_HTML/ibytransmit` endpoint with XML payloads abusing the `CODEX_PULL` transmission scheme. The activity reportedly attempted to read `/etc/passwd`, pointing to a local file read or path traversal exploitation chain, and occurred despite no known public proof-of-concept, suggesting private exploit tooling. Internet scanning data indicates more than **450** exposed Oracle EBS instances remain reachable, with attack activity recorded across multiple regions, including North America, Europe, and Asia.
Jul 12, 2026
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1,642 to 1,644, including **CVE-2026-46817**, a critical flaw in Oracle E-Business Suite Oracle Payments, and **CVE-2023-4346**, which affects KNX Protocol Connection Authorization Option 1. The Oracle issue affects Oracle Payments File Transmission in E-Business Suite versions `12.2.3` through `12.2.15` and is being actively exploited, while the KNX flaw can let an attacker purge devices that lack additional security options and set a BCU key that locks the device. The Oracle vulnerability can be exploited remotely over HTTP without authentication or user interaction through the `/OA_HTML/ibytransmit` endpoint using crafted XML `DeliveryRequest` payloads, allowing arbitrary file reads and possible exposure of credentials, encryption keys, payment processor API keys, and sensitive ERP or financial data. Oracle released fixes in its May 2026 Critical Patch Update and a supplementary update in June, and CISA directed organizations to apply vendor mitigations and follow **BOD 26-04** deadlines; security researchers warned that internet-facing, unpatched Oracle E-Business Suite instances should be treated as potentially compromised.
Jul 17, 2026
Oracle-related security advisories were issued for multiple enterprise products, including **Oracle Database Server**, **Oracle Fusion Middleware**, **Oracle REST Data Services**, **Oracle Java SE**, **Oracle Financial Services Applications**, and **Oracle E-Business Suite**. Germany's dCERT published separate advisories for each affected product line, indicating broad exposure across core Oracle infrastructure and business application environments. One of the disclosed flaws, **`CVE-2026-34275`**, affects the **Setup and Administration** component of **Oracle Advanced Inbound Telephony** in **Oracle E-Business Suite** versions **12.2.3 through 12.2.15**. Oracle rated the issue **critical** with a **CVSS v3.1 score of 9.8**, stating that an **unauthenticated attacker** with **network access over HTTP** could exploit it to achieve **full takeover** of the affected application. The vulnerability was disclosed as part of Oracle's broader Critical Patch Update, underscoring the need for organizations running Oracle platforms to prioritize patch review and remediation across exposed systems.
Jun 29, 2026