CVE-2026-46817
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jul 15, 2026
- US federal agencies must remediate it by Jul 18, 2026 (BOD 22-01)
- First attack observed 31 days after disclosure
- Used in ransomware campaigns
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Oct 29, 2026 Aug 7, 2026 Jul 15, 2026 Jul 10, 2026 Jul 9, 2026 Jul 1, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| oracle | e-business suite | <= 12.2.15 |
Related articles
CISA flags five older flaws in ProFTPD, Struts, BIND, ONLYOFFICE and Strapi as exploited
CISA added five older ProFTPD, Struts, BIND, ONLYOFFICE and Strapi flaws to KEV amid reported China-linked exploitation campaign.
ShinyHunters Suspect Detained as Boeing Reviews Separate Jeppesen ForeFlight Data Claims
Sources allege ShinyHunters operator Rey sought to extort Jeppesen ForeFlight as Boeing reviews claims; detention and data theft remain unconfirmed.
ShinyHunters Probe Reaches the Netherlands as Attacks Shift Toward Higher-Risk Targets
Dutch police detained convicted hacker Pepijn van der Stap in ShinyHunters probe amid Odido theft, FBI portal breach and PeopleSoft flaw exploitation.
Encoded Requests Let ShinyHunters-Linked Attackers Breach Oracle PeopleSoft Servers
UNC6240 exploits CVE-2026-35273 in Oracle PeopleSoft via encoded PSEMHUB requests, bypassing WAFs to deploy JSP shells and SIDEEYE backdoor.
FBI Probes ShinyHunters Claim After Recruitment Portal Defacement
FBI investigates ShinyHunters claim of FBIjobs.gov breach, portal defacement and alleged theft of agent data. Scope remains unverified.
ShinyHunters Hijacks Clop’s Tor Leak Site and Turns Extortion Against Its Operator
ShinyHunters hacked Clop's Tor leak site via Grav CMS flaw, defaced it, claims server logs and onion keys, and threatens 72-hour extortion.
Oracle CVE-2026-21962 enters KEV: maximum score and unauthorized access to WebLogic
CISA adds Oracle CVE-2026-21962 to KEV catalog. Critical CVSS 10.0 flaw allows unauthorized WebLogic access. Remediation due Aug 27, 2026.
This product uses the NVD API but is not endorsed or certified by the NVD.