cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Defused Reports Oracle E-Business Flaw Exploitation as 950 Instances Are Tracked Exposed

· Original article ↗

Summary

Defused reports observing exploitation of CVE-2026-46817, an unauthenticated takeover flaw in Oracle E-Business Suite. Oracle issued a patch in its May 2026 update; Shadowserver tracks about 950 exposed instances, with patched status unknown.

Key points

  • CVE-2026-46817 affects the File Transmission component of Oracle Payments in Oracle E-Business Suite and can allow unauthenticated attackers with HTTP access to take over vulnerable systems.
  • Defused says it observed an actor exploiting the flaw on its Oracle E-Business honeypots over the weekend.
  • Oracle has not flagged the vulnerability as exploited and released fixes in its May 2026 Critical Security Patch Update.
  • Shadowserver tracks about 950 Oracle E-Business instances exposed online; the article says it is unknown how many have been secured against this flaw.
  • Defused said there was no known prior exploitation and no public proof-of-concept code.

Article Details

Vulnerability Types
  • Unauthenticated remote system takeover
Severity
Critical; CVSS 9.8 as reported by Defused.
Exploitation Status
active
Exploit Availability
none_reported
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationDefused reported that an attacker exploited CVE-2026-46817 over HTTP to take over Oracle E-Business Suite systems.

CVE

CVE-2024-21182Cybersecurity and Infrastructure Security Agency (CISA) also tagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) patched two years ago as actively exploited in the wild.CVE-2025-61882Since early August 2025, the Clop extortion gang has exploited another Oracle EBS security flaw (CVE-2025-61882) in zero-day attacks targeting U.S.CVE-2026-35273Weeks later, Oracle mitigated a critical PeopleSoft Suite zero-day (CVE-2026-35273) that was exploited by the ShinyHunters extortion gang to gain unauthenticated remote code execution between May 27 and June 9 and toCVE-2026-46817Over 900 Oracle E-Business Suite instances are exposed online while attackers actively exploit a critical flaw in the Oracle Payments File Transmission component, tracked as CVE-2026-46817.

Threat Actors

ClopThe article reports that the extortion gang exploited Oracle E-Business Suite vulnerability CVE-2025-61882 in zero-day attacks beginning in early August 2025.ShinyHuntersThe article reports that the extortion gang exploited the PeopleSoft zero-day CVE-2026-35273 to gain unauthenticated remote code execution and steal data.

Vendors

OracleOver 900 Oracle E-Business Suite instances are exposed online while attackers actively exploit a critical flaw in the Oracle Payments File Transmission component, tracked as CVE-2026-46817.

Products

Oracle E-Business SuiteOver 900 Oracle E-Business Suite instances are exposed online while attackers actively exploit a critical flaw in the Oracle Payments File Transmission component, tracked as CVE-2026-46817.Oracle PaymentsOver 900 Oracle E-Business Suite instances are exposed online while attackers actively exploit a critical flaw in the Oracle Payments File Transmission component, tracked as CVE-2026-46817.Oracle WebLogicCybersecurity and Infrastructure Security Agency (CISA) also tagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) patched two years ago as actively exploited in the wild.PeopleSoft SuiteWeeks later, Oracle mitigated a critical PeopleSoft Suite zero-day (CVE-2026-35273) that was exploited by the ShinyHunters extortion gang to gain unauthenticated remote code execution between May 27 and June 9 and to

Related Articles