A critical unauthenticated vulnerability in Oracle E-Business Suite's Payments and File Transmission component has been under active exploitation since the weekend of June 28–29, 2026. Tracked as CVE-2026-46817 with a CVSS score of 9.8, the flaw allows any attacker who can reach an internet-exposed EBS instance to fully compromise it via a crafted HTTP request — no credentials required.

Oracle patched this in the May 2026 Critical Patch Update (CPU), released May 21, 2026. However, Shadowserver data shows approximately 450 Oracle EBS instances still directly accessible on the internet — roughly 200 of them in the US and Europe. Defused, a commercial honeypot network, confirmed exploitation attempts hitting those exposed instances as of June 28, 2026. No public proof-of-concept exploit has been released, but active exploitation without one means sophisticated actors already possess working capabilities.

If your organization runs Oracle EBS and you have not applied the May 2026 CPU, this is an emergency patching situation.

What the Vulnerability Is

Oracle E-Business Suite is a large enterprise application suite used primarily for financial management, supply chain operations, and HR — covering Oracle Payments, Accounts Payable/Receivable, General Ledger, and many other modules. Many organizations expose the EBS web application directly to the internet or to untrusted network segments to support remote access for employees, suppliers, and business partners.

CVE-2026-46817 exists in the Oracle Payments / File Transmission component of Oracle EBS. This component handles transmission of payment files (remittances, NACHA ACH files, BACS files, etc.) and is part of the EBS HTTP application tier. The flaw allows unauthenticated attackers to send a specially crafted HTTP request to the EBS web interface and achieve full application takeover without supplying any credentials.

Oracle's advisory classifies the attack vector as Network, with no authentication required and no user interaction needed. The confidentiality, integrity, and availability impacts are all rated High — the maximum in all three dimensions — producing the 9.8 CVSS score.

Oracle does not disclose fine-grained technical mechanics in its CVE advisories. The exploitation evidence from Defused honeypots confirms the flaw is exploitable remotely at scale, which is consistent with the unauthenticated network-accessible attack vector in the CVSS scoring.

Why It Matters

  • EBS is a high-value target. Oracle E-Business Suite typically manages payment processing, supplier bank accounts, payroll disbursements, and financial records. An attacker who achieves application-level access to EBS can potentially redirect ACH/wire payments, alter supplier banking details, exfiltrate confidential financial records, or use the compromise as a pivot point into the broader enterprise network.
  • Exploitation is already happening — without a public PoC. Defused's honeypot network recorded active exploitation attempts against internet-facing EBS over the June 28–29 weekend. The absence of a public proof-of-concept suggests this is targeted threat actor activity, not opportunistic script-kiddie scanning. That profile typically means ransomware operators, financially motivated intrusion groups, or nation-state actors rather than low-sophistication attackers.
  • Roughly 450 instances are exposed. Shadowserver's scanning data puts the internet-accessible EBS population at approximately 450 globally, with the largest concentrations in the US and Europe. This is a narrow attack surface — but every exposed instance is a high-value enterprise environment. Attackers don't need volume here; they need one unpatched instance at the right organization.
  • Six weeks of exposure since the Oracle CPU. The May 2026 CPU was released on May 21, 2026, yet hundreds of EBS instances had not applied the patch six weeks later. Enterprise EBS patching is notoriously slow due to complex customization layers and the need to validate business processes after upgrades — a window attackers are now actively exploiting.

Am I Affected?

You are affected if all of the following apply:

  1. You run Oracle E-Business Suite (any version line — 12.1.x or 12.2.x) as part of your IT environment.
  2. Your EBS application tier has not been patched with the Oracle May 2026 Critical Patch Update (CPU released May 21, 2026).
  3. Your EBS instance is reachable from untrusted networks — including the public internet, partner networks, or broad internal segments not restricted to the EBS application tier.

To determine patch status, log in to Oracle EBS as a System Administrator and navigate to Help → About Oracle Applications to check your release version. Then consult Oracle Support (support.oracle.com) for the May 2026 CPU patch list applicable to your EBS release line, or search My Oracle Support for patch CVE-2026-46817 to confirm its applicability.

Even if your EBS instance is not internet-facing, risk is not zero if it is accessible from segments where a single compromised endpoint could serve as a pivot.

What to Do About It: Step-by-Step

  1. Apply the Oracle May 2026 Critical Patch Update immediately. Download and apply the relevant CPU patches for your Oracle EBS version from My Oracle Support. The May 2026 CPU addresses CVE-2026-46817 across all affected release lines. Oracle Support document Doc ID 2939472.1 lists all applicable patch numbers by EBS release. Prioritize patching the EBS web/application tier nodes, as that is where the HTTP-facing component resides. If you are on a heavily customized EBS environment where full CPU application requires extended regression testing, apply the specific component-level patches that address CVE-2026-46817 first as an interim measure while full CPU testing proceeds in parallel.
  2. Restrict internet access to the EBS application tier while patching is underway. If you cannot patch within 24–48 hours:
    • Review your firewall rules and confirm which EBS-facing ports (typically 443 / 8000 / 4443) are accessible from the public internet.
    • If EBS does not need to be publicly accessible, place it behind a VPN or restrict access by IP allowlist at the perimeter firewall.
    • If public access is a business requirement, ensure a Web Application Firewall (WAF) is positioned in front of EBS and alert your WAF vendor to the need for a CVE-2026-46817 signature.
  3. Review EBS access logs for signs of exploitation. Examine your EBS access logs (Apache, Oracle HTTP Server, and Oracle Application Server logs on the application tier) for unexpected POST requests to File Transmission or Payments-related URLs, particularly from unexpected source IP addresses, and any unusual 200-range responses to unauthenticated requests at those endpoints. Correlate with your SIEM/EDR for any unexpected process spawning on EBS application tier hosts, new scheduled jobs, or outbound connections to unusual destinations originating from EBS processes.
  4. Validate supplier and payment data integrity after patching. Once you have confirmed whether your environment was reached prior to patching, perform a data integrity check on active payment file transmissions in progress, supplier bank account records (look for recent modifications), and any scheduled payment files pending transmission.
  5. Notify your Oracle account team. If you discover evidence of exploitation, Oracle Global Customer Support should be notified. Oracle has forensic resources available for major incidents involving EBS. Preserve logs before any remediation steps that might overwrite them.

Quick-Win Checklist

  • Confirmed whether Oracle May 2026 CPU has been applied to all EBS application tier nodes (check via My Oracle Support Doc ID 2939472.1).
  • Assessed internet exposure — confirmed which EBS ports are accessible from the public internet or untrusted networks.
  • Emergency firewall rule in place restricting EBS access while patching is scheduled (if not already patched).
  • Reviewed EBS web server access logs for unexpected requests to Payments / File Transmission endpoints.
  • Checked SIEM/EDR for anomalous activity on EBS application tier hosts (unexpected process spawning, outbound connections).
  • Validated supplier bank account records for unauthorized modifications.
  • Applied CPU patches and confirmed no regressions in EBS Payments module functionality.

Sources