Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Exploitation of Recent Oracle E-Business Suite Vulnerability Begins

Part of the CVE-2026-46817 story · since 30 Jun

Quiet for 2 weekslast report 28 Oct9 articles4 outlets
30 Jun · The Hacker News first29 Sep22 OctNowThis article3rd of 9
  • Tue 30 Jun, 06:01 UTC. The Hacker News, first report. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:32 UTC. Security Affairs, its first report on the story. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Wed 1 Jul, 20:11 UTC. Security Affairs. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 22:31 UTC. CISA, its first report on the story. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 23:13 UTC. CISA. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:41 UTC. Security Affairs. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 10:00 UTC. SecurityWeek. Hackers Probe Oracle EBS Flaw After October Patch. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.

A critical vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2026-46817 with a CVSS score of 9.8, is being actively exploited by threat actors. The flaw allows unauthenticated HTTP access that could lead to takeover of the Oracle Payments component. Oracle has released patches for this vulnerability as part of its May Critical Security Patch Update addressing 77 vulnerabilities total. Threat intelligence firm Defused reported recent exploitation attempts against the flaw in their EBS honeypots.

Organizations are advised to apply Oracle's patches immediately due to the critical nature of the vulnerability, especially given past incidents involving Oracle products being targeted by groups such as Cl0p and ShinyHunters.

How the story developed

All 9 articles
Quiet for 2 weekslast report 28 Oct9 articles4 outlets

9 articles from 4 outlets since 30 Jun. Quiet since 28 Oct. This was the 3rd report, 6 hours after the first.

Now30 Jun57912151827 Oct2468First reportThe Hacker News · 30 Jun, 06:01CISA alert15 Jul, 22:31 · official
  • Tue 30 Jun, 06:01 UTC. The Hacker News, first report. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:32 UTC. Security Affairs, its first report on the story. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins. Cites a CVE in CISA KEV. This article, 3rd of 9.
  • Wed 1 Jul, 20:11 UTC. Security Affairs. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 22:31 UTC. CISA, its first report on the story. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 23:13 UTC. CISA. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:41 UTC. Security Affairs. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 10:00 UTC. SecurityWeek. Hackers Probe Oracle EBS Flaw After October Patch. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Tue 30 JunDay 03
    1. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild06:01 · The Hacker News · First report · Exploited CVE · Known exploited CVE
    2. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-4681709:32 · Security Affairs · Known exploited CVE
    3. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins12:01 · SecurityWeek · Known exploited CVE · This article, 3rd of 9
  2. Wed 1 JulDay 11
    1. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed20:11 · Security Affairs · Known exploited CVE

  3. Quiet for 2 weeks

    Wed 15 JulDay 152
    1. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue22:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV23:13 · CISA · official · Known exploited CVE
  4. Fri 17 JulDay 171
    1. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog08:41 · Security Affairs · Known exploited CVE

  5. Quiet for 15 weeks

    Wed 28 OctDay 1202
    1. Hackers Probe Oracle EBS Flaw After October Patch10:00 · SecurityWeek · Picked up again · Known exploited CVE
    2. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution15:00 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in