CVE-2026-46817 Oracle E-Business Suite Payments Unauthenticated Takeover

Oracle E-Business SuiteCVE-2026-46817Unauthenticated RCEArbitrary File ReadActive Exploitation

A critical unauthenticated vulnerability (CVE-2026-46817, CVSS 9.8) in the File Transmission component of Oracle Payments within Oracle E-Business Suite (EBS) has been under active exploitation since 27.06.2026, when threat intelligence firm Defused recorded the first in-the-wild attack against its EBS honeypots roughly six weeks after Oracle's May 2026 patch. Shadowserver telemetry logged hundreds of exploitation attempts across multiple regions in the following days, and as of 01.07.2026 close to 950 internet-facing Oracle EBS instances remained exposed online with no confirmation of how many have been patched.

Indicators of Compromise

IPv4 (1)

45.84.137.125

Notes

ConclusionAs of this report, exploitation of CVE-2026-46817 appears limited to a single observed source running a targeted proof-of-concept file-read rather than broad opportunistic scanning, and no threat actor has claimed responsibility or been publicly attributed. Given the vulnerability's unauthenticated, low-complexity nature and the historical pattern of extortion groups such as Clop and ShinyHunters weaponizing Oracle EBS/PeopleSoft flaws for large-scale data theft, unpatched instances should be treated as high-risk for follow-on exploitation.SOCRadar's platform modules can help organizations track and respond to this threat:<a href="https://socradar.io/labs/ioc-radar/">IOC Radar</a><a href="https://socradar.io/extended-threat-intelligence/cyber-threat-intelligence/">Cyber Threat Intelligence</a><a href="https://socradar.io/extended-threat-intelligence/attack-surface-management/">Attack Surface Management</a><a href="https://socradar.io/extended-threat-intelligence/dark-web-monitoring/">Dark Web Monitoring</a><div> </div>

Mitigation

<div style="line-height:1.2;margin-top:16pt;margin-bottom:8pt;">Mitigation</div><div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Technique</th><th style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Mitigation ID</th><th style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Mitigation Name</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1190</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1051">M1051</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Update Software</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1190</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1035">M1035</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Limit Access to Resource Over Network</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1190</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1037">M1037</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Filter Network Traffic</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1190</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1030">M1030</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Network Segmentation</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1190</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1016">M1016</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Vulnerability Scanning</td></tr><tr style="height:0pt;"><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">T1005</td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1057">M1057</a></td><td style="border-left:solid #000000 0.5pt;border-right:solid #000000 0.5pt;border-bottom:solid #000000 0.5pt;border-top:solid #000000 0.5pt;vertical-align:middle;padding:4pt 5pt 4pt 5pt;overflow:hidden;overflow-wrap:break-word;">Data Loss Prevention</td></tr></tbody></table></div>