- Published on
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
- Authors
- Name
- DeepHorus
A critical security flaw in Oracle E-Business Suite is now being actively exploited in the wild, according to cybersecurity firm Defused Cyber. The vulnerability, tracked as CVE-2026-46817, carries a CVSS score of 9.8 and affects Oracle Payments, a component of the enterprise resource planning software. Researchers warn that unauthenticated attackers with network access via HTTP can compromise vulnerable instances, potentially leading to full system takeover.
Oracle E-Business Suite is a widely used enterprise software suite that manages financials, supply chain, and human resources for large organizations. The flaw stems from improper privilege management and authentication weaknesses within Oracle Payments. According to the National Vulnerability Database, successful exploitation allows an attacker to completely compromise the targeted Oracle Payments system.
The vulnerability impacts versions 12.2.3 through 12.2.15 of Oracle E-Business Suite. Oracle addressed the issue in its October 2024 Critical Patch Update, releasing patches for all affected versions. However, Defused Cyber reported that exploitation began over the weekend, targeting its Oracle E-Business honeypots. Notably, the firm stated there are no known previous exploitation attempts and no public proof-of-concept code exists for this flaw.
Currently, details remain scarce regarding the attack methodology, threat actors involved, and whether this is part of a broader campaign. Defused Cyber did not disclose specific indicators of compromise or attribution. The lack of public PoC suggests the exploit may be highly targeted or developed privately.
This incident follows a pattern of critical vulnerabilities in Oracle products being weaponized rapidly. Late last year, another E-Business Suite flaw, CVE-2025-61882 (CVSS 9.8), was exploited by the Cl0p ransomware gang, with attacks dating back to August 2025. More recently, a zero-day in Oracle PeopleSoft Suite (CVE-2026-35273, CVSS 9.8) was used by the ShinyHunters group in data theft and extortion campaigns, hitting automaker Nissan and exposing sensitive employee data.
Security researchers emphasize the increasing speed of exploitation. Jake Knott, principal security researcher at watchTowr, noted that attackers are weaponizing vulnerabilities faster than ever before. He urged organizations to assume compromise and activate incident response procedures to determine if access was obtained before patches were applied, what data was accessed, and whether persistence mechanisms were established. The attack chain for the PeopleSoft flaw, in particular, involved multiple vulnerabilities and delayed execution, indicating deep familiarity with Oracle's codebase.
Organizations running affected versions of Oracle E-Business Suite should immediately apply the October 2024 Critical Patch Update if not already done. Additionally, they should monitor for signs of compromise, review access logs, and prepare for potential remediation efforts. The active exploitation of CVE-2026-46817 underscores the critical importance of timely patch management, especially for high-severity vulnerabilities in widely deployed enterprise software. Continued vigilance and rapid incident response will be essential as threat actors increasingly exploit known flaws before patches are widely deployed.
