cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Attackers Exploit Critical Oracle E-Business Suite Flaw, Defused Reports

· Original article ↗

Summary

Defused reports observing attempts to exploit CVE-2026-46817, an unauthenticated HTTP takeover flaw in Oracle E-Business Suite's Oracle Payments File Transmission component. Oracle issued a patch in its May 2026 update.

Key points

  • CVE-2026-46817 affects the Oracle Payments File Transmission component of Oracle E-Business Suite.
  • The critical flaw can allow unauthenticated attackers with HTTP network access to take over vulnerable systems.
  • Defused says it observed an actor exploiting the flaw on its Oracle E-Business honeypots over the weekend; Oracle has not flagged the vulnerability as exploited in the wild.
  • Oracle released a fix in its May 2026 Critical Security Patch Update and urged customers to apply security patches promptly.
  • Shadowserver tracks more than 450 Oracle E-Business Suite instances exposed online; the article says their patch status is unknown.

Article Details

Vulnerability Types
  • Unauthenticated takeover over HTTP
Severity
Critical (CVSS 9.8)
Exploitation Status
active
Exploit Availability
none_reported
Patch Status
available
Workarounds
  • Apply Oracle's available security updates immediately.
  • Remain on actively supported versions and apply security patches without delay.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationDefused reported attackers exploiting CVE-2026-46817 over HTTP to take over Oracle E-Business Suite systems.

CVE

CVE-2024-21182Cybersecurity and Infrastructure Security Agency (CISA) also flagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) that was patched two years ago as actively exploited in attacks.CVE-2025-61882The Clop extortion gang exploited another Oracle EBS security flaw (CVE-2025-61882) in zero-day attacks targeting multiple U.S.CVE-2026-35273Weeks later, the company mitigated a critical PeopleSoft Suite zero-day vulnerability (CVE-2026-35273), which was actively exploited in ShinyHunter data theft attacks and allows unauthenticated remote code execution.CVE-2026-46817Attackers are actively exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw in the Oracle Payments File Transmission component that allows unauthenticated takeover over HTTP.

Threat Actors

ClopThe article reports that Clop exploited another Oracle E-Business Suite vulnerability, CVE-2025-61882, in zero-day attacks against multiple organizations in 2025.

Vendors

OracleAttackers are actively exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw in the Oracle Payments File Transmission component that allows unauthenticated takeover over HTTP.

Products

Oracle E-Business SuiteAttackers are actively exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw in the Oracle Payments File Transmission component that allows unauthenticated takeover over HTTP.Oracle PaymentsAttackers are actively exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw in the Oracle Payments File Transmission component that allows unauthenticated takeover over HTTP.

Related Articles