Loading story…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, raising the total from 1,642 to 1,644, including CVE-2026-46817, a critical flaw in Oracle E-Business Suite Oracle Payments, and CVE-2023-4346, which affects KNX Protocol Connection Authorization Option 1. The Oracle issue affects Oracle Payments File Transmission in E-Business Suite versions 12.2.3 through 12.2.15 and is being actively exploited, while the KNX flaw can let an attacker purge devices that lack additional security options and set a BCU key that locks the device.
The Oracle vulnerability can be exploited remotely over HTTP without authentication or user interaction through the /OA_HTML/ibytransmit endpoint using crafted XML DeliveryRequest payloads, allowing arbitrary file reads and possible exposure of credentials, encryption keys, payment processor API keys, and sensitive ERP or financial data. Oracle released fixes in its May 2026 Critical Patch Update and a supplementary update in June, and CISA directed organizations to apply vendor mitigations and follow BOD 26-04 deadlines; security researchers warned that internet-facing, unpatched Oracle E-Business Suite instances should be treated as potentially compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CISA directed U.S. federal agencies to secure Oracle E-Business Suite systems against CVE-2026-46817 under Binding Operational Directive 26-04. The order followed CISA's confirmation of active exploitation and set a remediation deadline of Saturday, July 18.
CISA updated its Known Exploited Vulnerabilities catalog to add CVE-2026-46817 affecting Oracle E-Business Suite and CVE-2023-4346 affecting KNX Protocol Connection Authorization Option 1. The catalog count increased from 1642 to 1644.
Threat intelligence firm Defused reported first observed exploitation of CVE-2026-46817 on June 27, 2026. It described six unauthenticated file-read attempts from a single Europe-based IP address and assessed the activity as a targeted proof-of-concept rather than broad scanning.
Oracle reinforced its remediation for CVE-2026-46817 with a supplementary update. The update followed the earlier May Critical Patch Update for the same Oracle E-Business Suite flaw.
Oracle issued fixes for CVE-2026-46817 in its Critical Patch Update. The vulnerability affects the Oracle Payments File Transmission component in Oracle E-Business Suite.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
thecybersecguru.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcethreataft.com
Open sourcelabs.beazley.security
Open sourcecve.org
Open sourcecve.org
Open sourceoracle.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle E-Business Suite customers are facing urgent risk from multiple critical vulnerabilities affecting versions `12.2.3` through `12.2.15`, including **CVE-2026-46817** in the Oracle Payments File Transmission component and **CVE-2026-46933** in Oracle Applications Manager. **CVE-2026-46817**, rated `CVSS 9.8`, can be exploited by an unauthenticated remote attacker over HTTP via the `/OA_HTML/ibytransmit` endpoint and may allow takeover of Oracle Payments and broader EBS environments. Oracle addressed the flaw in its May 2026 Critical Security Patch Update, while **CVE-2026-46933**, rated `CVSS 9.9`, was fixed in the June 2026 update as part of a broader set of 245 patched vulnerabilities. Security researchers reported that **CVE-2026-46817** is already being exploited in the wild, with honeypots capturing crafted XML payloads attempting to read `/etc/passwd`, indicating private exploit tooling was in use before any public proof of concept emerged. The exposure is amplified by the number of internet-facing deployments, with Shadowserver identifying more than 450 reachable EBS instances, and government and industry defenders warning organizations to patch immediately and restrict HTTP access to trusted network segments where possible.
Jul 17, 2026
Attackers are actively exploiting **CVE-2026-46817**, a critical `9.8` severity flaw in the Oracle Payments **File Transmission** component of **Oracle E-Business Suite**. The vulnerability affects EBS versions `12.2.3` through `12.2.15` and allows unauthenticated attackers with HTTP access to compromise confidentiality, integrity, and availability on vulnerable systems. Oracle addressed the issue in its May 2026 Critical Patch Update and urged customers to apply fixes immediately. Security researchers observed in-the-wild exploitation against Oracle EBS honeypots, including crafted `POST` requests to the `/OA_HTML/ibytransmit` endpoint with XML payloads abusing the `CODEX_PULL` transmission scheme. The activity reportedly attempted to read `/etc/passwd`, pointing to a local file read or path traversal exploitation chain, and occurred despite no known public proof-of-concept, suggesting private exploit tooling. Internet scanning data indicates more than **450** exposed Oracle EBS instances remain reachable, with attack activity recorded across multiple regions, including North America, Europe, and Asia.
Jul 12, 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including critical flaws in Oracle E-Business Suite (EBS) and Microsoft Windows SMB Client. Among these, CVE-2025-61884 and CVE-2025-61882 in Oracle EBS have been actively exploited in the wild, with attackers leveraging these vulnerabilities to gain unauthorized access and execute arbitrary code on affected systems. The exploitation of these flaws has led to significant breaches, including confirmed incidents at Harvard University and Envoy Air, the latter being tied to the Clop ransomware gang. Security researchers have highlighted that the Oracle EBS vulnerabilities are remotely exploitable without authentication, making them particularly dangerous for organizations with exposed instances. The vulnerabilities have enabled attackers to obtain interactive access to critical business applications, exfiltrate sensitive data, and potentially deploy ransomware. The attacks have been facilitated by public proof-of-concept exploits that were available before Oracle released emergency patches, leaving a window of opportunity for threat actors. The widespread use of Oracle EBS across sectors such as finance, healthcare, education, and government has amplified the impact, with many organizations potentially unaware of compromises that occurred during the zero-day period. CISA’s inclusion of these vulnerabilities in the KEV Catalog mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the flaws by a specified deadline, but the agency strongly urges all organizations to prioritize patching. The incidents have also exposed issues with vendor guidance, as conflicting deployment recommendations from Oracle left some enterprises unnecessarily exposed to attack. The Microsoft Windows SMB Client vulnerability (CVE-2025-33073), also added to the KEV Catalog, allows privilege escalation and is being actively exploited, affecting all supported Windows versions. The addition of these vulnerabilities to the KEV Catalog underscores the ongoing risk posed by unpatched systems and the need for robust vulnerability management practices. Security experts warn that the scalable nature of these attacks, particularly those targeting shared enterprise platforms, highlights the growing threat of supply chain compromises. The events have prompted calls for improved security hygiene, including restricting internet exposure of critical applications and ensuring timely application of security patches. The breaches and subsequent disclosures serve as a stark reminder of the evolving tactics of ransomware groups and the persistent threat posed by zero-day vulnerabilities in widely used enterprise software.
Jun 29, 2026