Skip to content
Sign in
CVE-2026-468179.8Critical

CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability

Oracle · E-Business Suite

Vendor fix available · Affected: Oracle E-Business Suite · Exploitation: in CISA KEV since 15 Jul

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue15 Jul
  2. Exploited (reported): not seen
  3. Scanning observedDefused, via SecurityWeek30 Jun
  4. Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub29 Jun
  5. Not established: not seen
12.3%probability of exploitation in the next 30 days
96th percentile
050100

Higher than 96% of scored CVEs

9.8CriticalCVSS 3.1
LowCrit.

Federal deadline

CISA KEV · added 15 Jul · catalogue entry

Passed 117 days ago

DescriptionNVD

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

What changed

  1. CISA added it to the KEV catalogue CISA
  2. Defused reported scanning, via SecurityWeek SecurityWeek
  3. PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage9 articles · 4 outlets

One row per outlet, in order of first report; the chart covers the last 90 days. First in our coverage: The Hacker News, 30 Jun.

Full timeline
Quiet for 2 weekslast report 28 Oct9 articles4 outlets
30 Jun · The Hacker News first29 Sep22 OctNow
  • Tue 30 Jun, 06:01 UTC. The Hacker News, first report. Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 09:32 UTC. Security Affairs, its first report on the story. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817. Cites a CVE in CISA KEV.
  • Tue 30 Jun, 12:01 UTC. SecurityWeek, its first report on the story. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins. Cites a CVE in CISA KEV.
  • Wed 1 Jul, 20:11 UTC. Security Affairs. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 22:31 UTC. CISA, its first report on the story. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue. Cites a CVE in CISA KEV.
  • Wed 15 Jul, 23:13 UTC. CISA. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV. Cites a CVE in CISA KEV.
  • Fri 17 Jul, 08:41 UTC. Security Affairs. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 10:00 UTC. SecurityWeek. Hackers Probe Oracle EBS Flaw After October Patch. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 15:00 UTC. The Hacker News. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution. Cites a CVE in CISA KEV.
All coveragerunning total2SecurityWeek1The Hacker…129 Oct4 Nov10Now
  • First report
  • Article
  • Running total
Show as table
2 articles about CVE-2026-46817 from 2 outlets
Published (UTC)OutletHeadline
28 Oct 10:00SecurityWeekHackers Probe Oracle EBS Flaw After October Patch
28 Oct 15:00The Hacker NewsHackers Target Patched Oracle EBS Flaw for Remote Code Execution
  1. Hackers Target Patched Oracle EBS Flaw for Remote Code Execution
    The Hacker News · mentions it in passing
  2. Hackers Probe Oracle EBS Flaw After October Patch
    SecurityWeek · mentions it in passing
  3. U.S. CISA adds KNX Association KNX Protocol Connection Authorization Option 1 and Oracle flaws to its Known Exploited Vulnerabilities catalog
    Security Affairs · mentions it in passing
  4. CISA flags Oracle E‑Business Suite flaw CVE‑2026‑46817 in KEV
    CISA · official notice
  5. CISA Adds CVE-2026-46817 to Known Exploited Vulnerabilities Catalogue
    CISA · official notice
  6. Oracle EBS flaw CVE-2026-46817 under attack, 950 systems exposed
    Security Affairs
  7. Exploitation of Recent Oracle E-Business Suite Vulnerability Begins
    SecurityWeek
  8. Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817
    Security Affairs
Show 1 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in