CVE-2026-46817: Oracle E-Business Suite Payments Authentication Bypass – Unauth Remote Takeover via /OA_HTML/ibytransmit

CVE-2026-46817 (TL-2026-1000), also tracked as Oracle Payments Zero-Day, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-06-30. It has no confirmed attribution, affects Oracle Corporation E-Business Suite - Payments Module, references 1 CVE (CVE-2026-46817), maps to 42 MITRE ATT&CK techniques (T1005, T1010, T1016), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-1000

Threat ID
TL-2026-1000
Also known as
Oracle Payments Zero-Day, ibytransmit Authentication Bypass, Oracle EBS Unauthenticated RCE, Payments File Transmission Bypass
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-30
Last reviewed
2026-06-30
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
financial services, health, government administration, retail, manufacturing, telecoms, energy, insurance, pharmaceuticals, utilities, transport, news - media
Target regions
North America, Europe, Asia Pacific, Middle East, Latin America, Africa, australia
Detection rules
9
Indicators of compromise
30

Malware and tooling in CVE-2026-46817

Malware and tooling: Oracle-Payments-Ransomware, HTTP-based C2 over EBS-native HTTP channels

Critical authentication bypass vulnerability in Oracle E-Business Suite Payments module allows unauthenticated remote attackers to achieve complete compromise of Payments systems via the /OA_HTML/ibytransmit endpoint. Improper privilege management and missing authentication controls enable file read, modification, and system takeover. CVSS 9.8. Active exploitation in-the-wild since June 27, 2026, six weeks post-patch.

How CVE-2026-46817 works

CVE-2026-46817 is a critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite (EBS) Payments module affecting versions 12.2.3 through 12.2.15. The vulnerability resides in the File Transmission component, specifically the /OA_HTML/ibytransmit HTTP endpoint, which lacks proper authentication and authorization controls. Attackers can exploit this vulnerability to:

1. AUTHENTICATION BYPASS: The ibytransmit endpoint fails to properly enforce authentication requirements, allowing unauthenticated HTTP requests to trigger sensitive Payments operations.

2. PRIVILEGE ESCALATION: Improper privilege management (CWE-269) allows attackers to perform operations that should be restricted to authenticated administrators, including file operations, database access, and system configuration changes.

3. REMOTE CODE EXECUTION: By combining unauthenticated access with privilege escalation, attackers can execute arbitrary code on the target system with the privileges of the EBS application server, leading to complete system compromise.

4. DATA EXFILTRATION & MODIFICATION: Successful exploitation enables unauthorized access to sensitive payment data, customer financial information, transaction records, and ability to modify transactions or redirect payments.

The vulnerability is easily exploitable via HTTP network access with no user interaction required (Network attack vector, CVSS AV:N/AC:L/PR:N/UI:N). Oracle released a critical patch in May 2026 (CSPU), but exploitation was observed in-the-wild beginning June 27, 2026 – approximately six weeks after patch release – indicating either: Delayed patch deployment by affected organizations, Coordinated targeting of known-unpatched systems, or Pre-patch exploitation before public awareness. The exploit mechanics leverage HTTP GET/POST requests to the unauthenticated ibytransmit endpoint, making this trivially exploitable at scale without sophisticated tools. The affected versions represent mature, widely-deployed EBS instances across financial, healthcare, government, and retail sectors globally.

MITRE ATT&CK techniques used in TL-2026-1000

Collection

T1005 Data from Local System; T1039 Data from Network Shared Drive; T1113 Screen Capture; T1115 Clipboard Data; T1213 Data from Information Repositories

Discovery

T1010 Application Window Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1201 Password Policy Discovery

discovery

T1016 System Network Configuration Discovery

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal

Execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1106 Native API

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component; T1543 Create or Modify System Process

Command and Control

T1105 Ingress Tool Transfer

Credential Access

T1110 Brute Force; T1528 Steal Application Access Token; T1552 Unsecured Credentials

stealth

T1202 Indirect Command Execution

Lateral Movement

T1210 Exploitation of Remote Services

Impact

T1491 Defacement; T1499 Endpoint Denial of Service; T1561 Disk Wipe; T1565 Data Manipulation; T1657 Financial Theft

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1583 Acquire Infrastructure

Reconnaissance

T1589 Gather Victim Identity Information; T1590 Gather Victim Network Information

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-46817

  • Oracle Corporation — E-Business Suite - Payments Module
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: 12.2.16 and later with CSPU May 2026

Remediation for CVE-2026-46817

Patches

  • Apply Oracle Critical Security Patch Update (CSPU) May 2026 or later
  • Apply post-patch follow-up updates if released by Oracle for this CVE
  • Verify patch application by checking Oracle Payments product version in System Administrator > Tools > About Oracle Applications
  • Test patch in staging environment before production rollout to minimize downtime

Immediate actions

  • Identify and isolate all Oracle EBS Payments instances running versions 12.2.3-12.2.15
  • Block external access to /OA_HTML/ibytransmit endpoint at firewall/WAF level
  • Implement IP allowlisting for EBS Payments access
  • Monitor all HTTP requests to /OA_HTML/ibytransmit and related endpoints for suspicious activity
  • Review payment transaction logs for unauthorized modifications or transfers dating back to June 27, 2026
  • Check HTTP access logs for unauthenticated requests to /OA_HTML/ibytransmit, /oa_html/ibytransmit, or mixed-case variants
  • Isolate Payments databases from untrusted networks immediately

Workarounds

  • Disable or restrict /OA_HTML/ibytransmit endpoint if not required for operations
  • Implement reverse proxy authentication requirements before routing to Payments module
  • Use VPN/bastion host to restrict Payments access to authorized networks only
  • Reduce permissions on EBS application server OS-level accounts
  • Implement rate-limiting on /OA_HTML/ibytransmit endpoint
  • Require mutual TLS (mTLS) for all Payments endpoint access

Longer-term hardening

  • Deploy EDR/XDR to detect suspicious EBS process execution and file operations
  • Implement application-layer WAF rules to enforce authentication on all Payments endpoints
  • Deploy behavioral analytics to detect unusual payment transaction patterns
  • Segment EBS Payments infrastructure from other business systems
  • Implement database activity monitoring (DAM) on Payments schema
  • Deploy DLP to prevent unauthorized data exfiltration from Payments systems
  • Establish real-time SOC alerting on Payments transaction modifications

CVEs associated with CVE-2026-46817

CVE-2026-46817

Weaknesses (CWE) in CVE-2026-46817

CWE-269, CWE-287, CWE-306

Timeline of CVE-2026-46817

  • Security researcher or Oracle internal team discovers authentication bypass in /OA_HTML/ibytransmit endpoint during code review or security assessment
  • Oracle releases Critical Security Patch Update (CSPU) May 2026 addressing CVE-2026-46817 in EBS Payments module; patch deployment window begins for customers
  • Estimated pre-disclosure coordination period ends; vendors and security community prepare defenses; vulnerability details remain under embargo
  • CVE-2026-46817 officially published by NVD with CVSS 9.8, confirmed as unauthenticated remote code execution vulnerability; broader security awareness begins
  • Organizations begin patching cycles; widespread delays observed as many enterprises defer non-critical maintenance or miss patch window
  • Opportunistic reconnaissance and scanning of internet-facing Oracle EBS instances escalates; attackers probe for vulnerable Payments endpoints
  • First exploitation attempts detected in-the-wild, ~6 weeks after patch release; indicates either delayed patching, coordinated targeting, or pre-patch exploitation; forensic evidence shows HTTP POST requests to /OA_HTML/ibytransmit
  • Security researchers begin publishing technical analysis and exploitation details on blogs, forums, and GitHub; PoC code development accelerates
  • Security vendors and threat intelligence platforms add CVE-2026-46817 to mass vulnerability scanning tools; Shodan and other reconnaissance tools report thousands of exposed instances
  • Threat intelligence platforms (CISA, vendors, researchers) begin tracking CVE-2026-46817 exploitation campaigns and correlating incident data
  • HelpNetSecurity publishes article warning of active in-the-wild exploitation; begins widespread security community awareness and media coverage
  • Public PoC exploits expected to be released or refined; exploitation activity likely to accelerate as barriers to entry lower
  • First ransomware campaigns leveraging CVE-2026-46817 observed targeting Oracle EBS Payments systems; financial extortion attempts begin
  • Mass exploitation phase detected; worm-like behavior observed as botnets and automated scanners target unpatched Payments instances globally

Sources cited for CVE-2026-46817

Threats related to CVE-2026-46817

Detection coverage for TL-2026-1000

As of 2026-06-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1000 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats