CVE-2026-46817

Oracle E-Business Suite contains a critical improper privilege management flaw (CVE-2026-46817) in the File Transmission component of Oracle Payments, affecting versions 12.2.3 through 12.2.15. The flaw is easily exploitable: an unauthenticated attacker with network access over HTTP can trigger it, with no credentials or user interaction required. Successful exploitation results in takeover of Oracle Payments, with high confidentiality, integrity, and availability impact (CVSS 3.1 9.8). Organizations running the affected E-Business Suite releases — especially those exposing the Payments/File Transmission interface to untrusted networks — are in scope. The issue was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-15, researchers have observed exploitation in the wild, and EPSS assigns a 13% probability of exploitation within 30 days (96th percentile).

What to do: Apply the remediation provided in Oracle's security advisory for CVE-2026-46817 to all Oracle E-Business Suite 12.2.3–12.2.15 environments running Oracle Payments, and in the meantime restrict HTTP/network access to the File Transmission component. Because the flaw is being actively exploited, review EBS/Payments access logs for unauthenticated requests and anomalous file-transmission activity to check for compromise. Federal agencies must apply mitigations in line with CISA BOD 26-04 timelines or discontinue use of the product if mitigations are unavailable.