CVE-2026-46817
Oracle E-Business Suite Improper Privilege Management Vulnerability
Description
CVE-2026-46817 is a critical vulnerability in the Oracle Payments product of Oracle E-Business Suite (File Transmission component) that allows an unauthenticated attacker with network access via HTTP to take over Oracle Payments. Rated CVSS 9.8 (Critical), it affects Oracle E-Business Suite versions 12.2.3 through 12.2.15 and is rooted in authentication and privilege-management weaknesses: improper privilege management, improper authentication, and missing authentication for a critical function. Because Oracle Payments handles an organization's financial transaction flows, a takeover directly threatens payment data and processes. CISA has added CVE-2026-46817 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-18, confirming active exploitation of this Oracle E-Business Suite vulnerability in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| oracle | e-business suite | >= 12.2.3, <= 12.2.15 |
References
- https://www.oracle.com/security-alerts/cspumay2026.html(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817(US Government Resource)
Weakness Type
CWE-269: Improper Privilege Management
Improper privilege management occurs when a product does not properly assign, modify, track, or check privileges for users, processes, or systems. In Oracle E-Business Suite, this weakness contributes to the ability of an unprivileged network attacker to reach functionality in Oracle Payments that should be reserved for authorized roles.
Learn more: CWE-269 — Improper Privilege Management
CWE-287: Improper Authentication
Improper authentication occurs when software does not sufficiently prove that an actor's claimed identity is correct. In the File Transmission component of Oracle Payments, flawed authentication logic allows attackers to interact with protected functionality without validly proving their identity.
Learn more: CWE-287 — Improper Authentication
CWE-306: Missing Authentication for Critical Function
Missing authentication for a critical function means functionality that clearly requires a provable user identity performs no authentication at all. In this CVE, critical Oracle Payments operations are reachable over HTTP without credentials, which is what makes the attack fully unauthenticated.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2026-46817 carries a CVSS 3.1 base score of 9.8 (Critical) because it is remotely exploitable without physical access via HTTP, easy to exploit with no special conditions needed, requires no authentication, and needs no user action. Oracle itself describes the flaw as easily exploitable and states that successful attacks can result in takeover of Oracle Payments. Confidentiality (High): payment configurations and financial transaction data processed by Oracle Payments are exposed. Integrity (High): an attacker controlling the payments module can manipulate payment instructions and financial records — a direct fraud risk. Availability (High): takeover allows disruption of payment processing, which for many organizations is a business-critical function. The EPSS score of about 1.0% is still moderate, but the CISA KEV listing confirms this vulnerability is already being exploited in practice, so internet-reachable E-Business Suite instances face immediate risk.
Exploit Maturity
CVE-2026-46817 is listed in CISA's Known Exploited Vulnerabilities catalog, which confirms active exploitation in the wild; ransomware usage is currently marked as Unknown. No public exploit code is linked in the available references — the published sources are Oracle's May 2026 CPU advisory and the CISA KEV entry. The EPSS score of 1.0% (60.4th percentile) suggests exploitation is not yet broadly automated, but confirmed real-world attacks against an unauthenticated takeover flaw in a financial module mean affected E-Business Suite deployments should be patched before the 2026-07-18 KEV deadline without waiting for further exploit signals.
Remediation
- Follow the CISA KEV required action: "Apply mitigations in accordance with vendor instructions", ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements — and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-18.
- Apply the patches from Oracle's May 2026 Critical Security Patch Update advisory to all Oracle E-Business Suite environments running versions 12.2.3 through 12.2.15.
- Until patched, restrict HTTP access to Oracle E-Business Suite: do not expose the application tier directly to the internet, place it behind a VPN or authenticating reverse proxy, and limit access to the Oracle Payments and File Transmission endpoints to trusted networks.
- Review application and web server logs for unauthenticated or anomalous requests against Oracle Payments and File Transmission functionality, and audit payment configurations and recent payment instructions for unauthorized changes, given confirmed in-the-wild exploitation.
- As long-term hardening against the underlying weaknesses (CWE-269, CWE-287, CWE-306), enforce authentication at the API and service layer for every critical function, implement robust role-based access control with server-side privilege checks, and never rely on obscurity to protect administrative or financial interfaces.
Technical Details
Technically, CVE-2026-46817 resides in the File Transmission component of the Oracle Payments product within Oracle E-Business Suite and combines three related weakness classes. Missing authentication for a critical function (CWE-306) means payment-related operations are reachable over HTTP without any credential check; improper authentication (CWE-287) covers the failure to correctly prove caller identity where checks exist; and improper privilege management (CWE-269) means the application does not properly restrict which actors may perform privileged payment operations. Together these flaws let a remote attacker interact with functionality that should require an authenticated, privileged identity, culminating in what Oracle describes as takeover of Oracle Payments. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H quantifies this: network attack vector over HTTP (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), and high confidentiality, integrity, and availability impact within an unchanged scope (S:U).
Frequently Asked Questions
Is CVE-2026-46817 being actively exploited?
Yes. CVE-2026-46817 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, with a federal remediation deadline of 2026-07-18. Ransomware usage is currently marked as Unknown, and the EPSS score of about 1.0% sits at the 60th percentile.
What products are affected by CVE-2026-46817?
The vulnerability affects the Oracle Payments product of Oracle E-Business Suite, specifically the File Transmission component, in versions 12.2.3 through 12.2.15. Any organization running a supported E-Business Suite 12.2 release in that range should assume it is affected until patched.
How do I fix CVE-2026-46817?
Apply the fixes from Oracle's May 2026 Critical Security Patch Update to all affected E-Business Suite environments. Until patching is complete, keep the application tier off the internet, restrict HTTP access to Oracle Payments endpoints to trusted networks, and audit payment data for unauthorized changes.
How severe is CVE-2026-46817?
CVE-2026-46817 is rated Critical with a CVSS 3.1 base score of 9.8: an unauthenticated network attacker can take over Oracle Payments with high impact on confidentiality, integrity, and availability. Its inclusion in the CISA KEV catalog confirms the risk is practical, not theoretical, and the financial nature of the affected module raises the business impact further.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.