Oracle E-Business Suite Payments improper privilege management (unauth RCE)
A critical improper-privilege-management flaw in the Oracle Payments component of Oracle E-Business Suite (File Transmission) that lets an unauthenticated network attacker take over Oracle Payments. Patched in Oracle's May 2026 Critical Patch Update; added to CISA KEV on July 15, 2026.
- Vendor
- Oracle
- Product
- E-Business Suite — Oracle Payments (versions 12.2.3–12.2.15)
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.8%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-46817 being exploited?
Yes. CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.8% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-46817 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-46817 is an improper-privilege-management vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission), affecting versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTP can compromise Oracle Payments — CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Oracle patched the flaw in its May 2026 Critical Patch Update. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-07-15, starting a federal-civilian remediation clock under BOD 26-04.
Why it matters
Oracle E-Business Suite is the ERP backbone at a large share of Fortune 500 and government-adjacent organizations. The Payments module handles payment-instrument data and payment-file transmission, so a full compromise of that module is not “an internal-application bug” — it is compromise of the system that moves money and holds the credentials and tokens that authenticate to payment processors.
Unauthenticated over HTTP means there is no credential requirement, no user interaction, and no privilege prerequisite. Any Internet-exposed EBS Payments endpoint is directly reachable by an attacker with the exploit; internally exposed endpoints are reachable by any actor who has already reached the corporate network.
What to do
Apply Oracle’s May 2026 Critical Patch Update to the affected Oracle Payments version if you haven’t already — the fix has been available for roughly seven weeks. Confirm the running EBS build number against the cspumay2026 advisory rather than trusting patch-management-tool reports alone. NVD’s canonical record is here.
If your EBS Payments interface has been Internet-exposed and unpatched, treat this as a possible-compromise scenario rather than a routine patch. Review Payments transmission logs for anomalous file transfers, review Oracle Payments account activity for unfamiliar service or admin accounts, and rotate credentials the Payments module holds for downstream payment-processor integrations.
Other Oracle E-Business Suite CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 7.5 | 95.9% | |
| CVE-2025-61882 Oracle E-Business Suite BI Publisher Integration unauth RCEransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.7% | |
| CVE-2022-21587 Oracle E-Business Suite Unspecified Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 98.3% |
