Vendor

Oracle

Vulnerabilities and patches across Oracle's enterprise stack — E-Business Suite (including Payments), Fusion Middleware, WebLogic Server, Database, and Java — driven by the January, April, July, and October Critical Patch Update cycle.

CVEs

CVE-2026-46817

[ CRITICAL ] CVSS 9.8 kev

Oracle E-Business Suite Payments improper privilege management (unauth RCE)

A critical improper-privilege-management flaw in the Oracle Payments component of Oracle E-Business Suite (File Transmission) that lets an unauthenticated network attacker take over Oracle Payments. Patched in Oracle's May 2026 Critical Patch Update; added to CISA KEV on July 15, 2026.

Oracle / E-Business Suite — Oracle Payments (versions 12.2.3–12.2.15) Jul 15

Articles

~/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission

● Breaking

oracle

CISA KEV: Oracle EBS Payments 9.8 unauth RCE lands

CISA added CVE-2026-46817 to KEV on Wednesday: unauthenticated CVSS 9.8 takeover of Oracle E-Business Suite Payments. Oracle's May 2026 CPU already has the fix.

Jul 15 read →