CVE-2026-46817

What it actually does

CVE-2026-46817 is an unauthenticated, network-exploitable vulnerability in the Oracle Payments component of Oracle E-Business Suite, specifically the File Transmission functionality. An attacker with HTTP access to an affected Oracle E-Business Suite instance can compromise Oracle Payments without credentials or user interaction. The CVSS vector indicates low attack complexity, no required privileges, no user interaction, and high confidentiality, integrity, and availability impact, meaning successful exploitation can allow full takeover of the Oracle Payments application context, access to sensitive payment-related data, modification of transactions or configuration, and disruption of payment processing workflows.

Why it matters to the business

Organizations running affected Oracle E-Business Suite versions may face direct risk to payment operations, financial data confidentiality, transaction integrity, and application availability. Because the vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and affects supported Oracle E-Business Suite versions 12.2.3 through 12.2.15, remediation should be treated as urgent even where the EPSS score is moderate. Compromise of Oracle Payments can lead to payment fraud risk, operational outages, audit findings, regulatory exposure, and loss of trust in financial processing systems. CISA’s KEV remediation due date is 2026-07-18, which should be used as a hard deadline for exposed or government-regulated environments.

How an attack unfolds

An attacker first identifies an internet-accessible or internally reachable Oracle E-Business Suite deployment exposing HTTP endpoints associated with Oracle Payments and File Transmission. Because the flaw requires no authentication, the attacker does not need valid application credentials. The attacker sends crafted HTTP requests to the vulnerable component, triggering improper privilege management and gaining unauthorized control over Oracle Payments functionality. From there, the attacker may access sensitive payment configuration or transmitted payment data, alter payment-related workflows, stage additional payloads through application functionality, disrupt payment processing, or use the compromised application tier as a foothold for broader Oracle E-Business Suite reconnaissance and lateral movement. Active exploitation has been reported in the wild, so organizations should assume that exposed systems are at elevated risk and review historical evidence, not only patch going forward.

How to fix it

Apply Oracle’s security update for Oracle E-Business Suite that addresses this Oracle Payments File Transmission vulnerability. The affected supported versions are Oracle E-Business Suite 12.2.3 through 12.2.15; if no discrete fixed application version is available in asset records, use Oracle’s latest applicable Critical Patch Update, Security Alert, or one-off patch for the installed E-Business Suite release and Oracle Payments component. Prioritize internet-facing, partner-facing, and high-trust internal E-Business Suite deployments first. If immediate patching is not possible, restrict HTTP/S access to Oracle E-Business Suite to trusted networks and application gateways, block direct access to Oracle Payments/File Transmission endpoints from untrusted sources, enforce strong network segmentation around the application tier, and monitor for unauthenticated requests to payment-related functionality. Mitigations should be treated as temporary because the vulnerability allows unauthenticated takeover of a business-critical financial component.

How to confirm the fix worked

Confirm exposure by inventorying Oracle E-Business Suite deployments and verifying whether Oracle Payments is installed or enabled and whether the running release is within 12.2.3 through 12.2.15. Validate remediation by confirming the relevant Oracle CPU/Security Alert/one-off patch is installed successfully on all application tier nodes, reviewing Oracle patch inventories and application version metadata, and ensuring post-patch functional testing covers Oracle Payments File Transmission workflows. From a defensive-control perspective, verify that unauthenticated external clients cannot directly reach Oracle Payments/File Transmission functionality unless explicitly required, and confirm WAF, reverse proxy, and application logs show expected access control behavior after patching or mitigation. Vulnerability scanners should be supplemented with Oracle patch inventory checks because generic HTTP fingerprinting may not reliably determine E-Business Suite patch state.

Typical attack path

1. Discover Oracle E-Business Suite instances reachable over HTTP or HTTPS.
2. Fingerprint the instance to determine whether Oracle Payments functionality is exposed and whether the version falls within 12.2.3 through 12.2.15.
3. Send unauthenticated crafted HTTP requests to the Oracle Payments File Transmission component.
4. Abuse the privilege management flaw to compromise Oracle Payments without valid credentials.
5. Access, modify, or disrupt payment-related data, transmission jobs, configuration, or workflows.
6. Use the compromised application context for persistence, further application abuse, data theft, or movement toward adjacent enterprise systems.

How to detect it

Review evidence from web access logs, reverse proxy logs, WAF events, Oracle HTTP Server logs, WebLogic logs, Oracle E-Business Suite application logs, concurrent manager logs, file transmission logs, and database audit/application audit records associated with Oracle Payments. Focus on unauthenticated or pre-authentication HTTP requests to payment and file transmission functionality, especially from unfamiliar internet sources, scanning infrastructure, hosting providers, or sources with no legitimate business reason to access Oracle E-Business Suite. Look for abnormal spikes in 200, 302, 400, 401, 403, or 500 responses around Oracle Payments endpoints, repeated probing of E-Business Suite paths, unusual user-agent strings, and requests that interact with payment/file-transfer functionality without a normal authenticated session flow. Investigate application events showing unexpected Oracle Payments configuration changes, new or altered payment transmission profiles, modified payment instructions, unauthorized payment file generation or retrieval, unexplained concurrent requests, and outbound connections from application tier hosts after suspicious HTTP activity. Because exploitation is reported in the wild and the issue is KEV-listed, perform retrospective hunting back to at least 2026-05-28, and farther back if logs are available. If exploitation is suspected, preserve web/application logs, application-tier filesystem artifacts, recent payment transmission files, audit records, and memory/process evidence before remediation activity overwrites volatile data.

• /OA_HTML/
• /OA_CGI/
• Oracle Payments
• File Transmission
• IBY
• iby
• payment transmission
• transmission profile
• concurrent request
• Oracle HTTP Server
• oacore
• forms
• oafm

What your security team should do

• Treat this as an emergency remediation item for any exposed Oracle E-Business Suite deployment because it is KEV-listed and actively exploited in the wild.
• Identify all Oracle E-Business Suite instances, including non-production, disaster recovery, partner-accessible, and internally routed deployments, and determine whether they run versions 12.2.3 through 12.2.15.
• Apply the relevant Oracle security patch or latest applicable CPU/one-off patch for Oracle Payments as soon as possible, with the CISA KEV due date of 2026-07-18 as the latest acceptable deadline.
• Temporarily restrict network access to Oracle E-Business Suite HTTP/S endpoints to trusted source ranges, VPNs, reverse proxies, or application gateways until patching is complete.
• Review web server, reverse proxy, WAF, Oracle HTTP Server, WebLogic, and Oracle E-Business Suite application logs for suspicious unauthenticated access to Oracle Payments and File Transmission functionality since at least the publication date, 2026-05-28.
• Hunt for signs of payment workflow manipulation, unauthorized configuration changes, unexpected transmission jobs, suspicious file uploads/downloads, and unusual application-tier process activity.
• Preserve forensic logs before patching or restarting systems where suspicious activity is observed.
• Increase monitoring for Oracle E-Business Suite authentication anomalies, new administrative users, modified responsibilities/roles, unexpected concurrent requests, and outbound connections from application servers.
• Coordinate with finance, payments operations, and audit teams to review recent payment file transmissions and payment configuration changes for unauthorized activity.