CVE-2026-46817
Published 2026-05-28 · Updated 2026-07-21 · Source secalert_us@oracle.com
Summary
CVE-2026-46817 is a critical-severity (CVSS 9.8) vulnerability in Oracle E-Business Suite. CISA added it to the Known Exploited Vulnerabilities catalog on July 15, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 18, 2026. CISA does not currently list it as used in ransomware campaigns. Oracle has 46 vulnerabilities in the KEV catalog, 13 of them linked to ransomware.
All 46 known-exploited Oracle vulnerabilities →Description
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Oracle — E-Business Suite
Name: Oracle E-Business Suite Improper Privilege Management Vulnerability
Date added: 2026-07-15 · Due: 2026-07-18
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.