Loading vulnerability…
Unauthenticated Takeover in Oracle Payments File Transmission
CVE-2026-46817 is a critical improper privilege management vulnerability in the File Transmission component of Oracle Payments within Oracle E-Business Suite. It affects supported versions 12.2.3 through 12.2.15. An unauthenticated attacker can send crafted HTTP requests to compromise and potentially take over Oracle Payments. Exploitation has low complexity and requires neither privileges nor user interaction. The vulnerability has a CVSS 3.1 score of 9.8, with high confidentiality, integrity, and availability impacts. Active exploitation has been confirmed, and CISA has included the vulnerability in its Known Exploited Vulnerabilities catalog.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can result in full compromise of Oracle Payments, exposing sensitive payment and financial information, allowing unauthorized modification of application data or payment workflows, and disrupting payment processing. The confirmed takeover impact concerns Oracle Payments; operating-system command execution and compromise of other E-Business Suite components are not established.
If you can’t patch tonight, do this now.
Restrict E-Business Suite web interfaces to trusted networks and remove unnecessary public HTTP exposure. Review web server and application access logs for suspicious requests targeting Oracle Payments, and monitor for unauthorized transactions, configuration changes, and unusual application activity. Investigate evidence of prior compromise and rotate affected credentials and keys if compromise is detected. Access restrictions and monitoring are interim measures, not substitutes for patching.
Patch, then assume compromise.
Apply the Oracle May 2026 Critical Security Patch Update released on May 28, 2026, or a subsequent applicable update that includes the fix for CVE-2026-46817. Follow Oracle's patch instructions for the installed E-Business Suite release; a specific fixed version is not identified. Perform compromise assessment and forensic triage of previously exposed deployments because patching does not remove an existing intrusion.
No validated public exploits yet. Hidden: 2 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
238 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.