Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817

Part of the CVE-2026-46817 story · since 30 Jun

Quiet for 2 weekslast report 28 Oct9 articles4 outlets
30 Jun · The Hacker News first29 Sep22 OctNowThis article2nd of 9
  • Tue 30 Jun, 06:01 UTC. The Hacker News, first report. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:32 UTC. Security Affairs, its first report on the story. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817. Cites a CVE in CISA KEV. This article, 2nd of 9.
  • Tue 30 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins. Cites a CVE in CISA KEV.
  • Wed 1 Jul, 20:11 UTC. Security Affairs. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 22:31 UTC. CISA, its first report on the story. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 23:13 UTC. CISA. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:41 UTC. Security Affairs. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 10:00 UTC. SecurityWeek. Hackers Probe Oracle EBS Flaw After October Patch. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.

A critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite has been actively exploited by attackers, allowing unauthenticated access to Oracle Payments systems. This flaw, with a CVSS score of 9.8, affects versions 12.2.3 to 12.2.15. Though Oracle has issued a patch, the flaw had no known prior exploitation or public proof-of-concept code available. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is also monitoring related vulnerabilities. The issue underscores the importance of timely patching, especially in a landscape where zero-day exploits can affect large numbers of organizations.

How the story developed

All 9 articles
Quiet for 2 weekslast report 28 Oct9 articles4 outlets

9 articles from 4 outlets since 30 Jun. Quiet since 28 Oct. This was the 2nd report, 4 hours after the first.

Now30 Jun57912151827 Oct2468First reportThe Hacker News · 30 Jun, 06:01CISA alert15 Jul, 22:31 · official
  • Tue 30 Jun, 06:01 UTC. The Hacker News, first report. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:32 UTC. Security Affairs, its first report on the story. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817. Cites a CVE in CISA KEV. This article, 2nd of 9.
  • Tue 30 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins. Cites a CVE in CISA KEV.
  • Wed 1 Jul, 20:11 UTC. Security Affairs. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 22:31 UTC. CISA, its first report on the story. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 23:13 UTC. CISA. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:41 UTC. Security Affairs. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 10:00 UTC. SecurityWeek. Hackers Probe Oracle EBS Flaw After October Patch. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 9 articles as a list
  1. Tue 30 JunDay 03
    1. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild06:01 · The Hacker News · First report · Exploited CVE · Known exploited CVE
    2. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-4681709:32 · Security Affairs · Known exploited CVE · This article, 2nd of 9
    3. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins12:01 · SecurityWeek · Known exploited CVE
  2. Wed 1 JulDay 11
    1. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed20:11 · Security Affairs · Known exploited CVE

  3. Quiet for 2 weeks

    Wed 15 JulDay 152
    1. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue22:31 · CISA · official · CISA alert · Picked up again · Known exploited CVE
    2. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV23:13 · CISA · official · Known exploited CVE
  4. Fri 17 JulDay 171
    1. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog08:41 · Security Affairs · Known exploited CVE

  5. Quiet for 15 weeks

    Wed 28 OctDay 1202
    1. Hackers Probe Oracle EBS Flaw After October Patch10:00 · SecurityWeek · Picked up again · Known exploited CVE
    2. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution15:00 · The Hacker News · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in