# CVE-2026-46817: Oracle E-Business Suite Payments Authentication Bypass – Unauth Remote Takeover via /OA_HTML/ibytransmit

> Critical authentication bypass vulnerability in Oracle E-Business Suite Payments module allows unauthenticated remote attackers to achieve complete compromise of Payments systems via the /OA_HTML/ibytransmit endpoint. Improper privilege management and missing authentication controls enable file read, modification, and system takeover. CVSS 9.8. Active exploitation in-the-wild since June 27, 2026, six weeks post-patch.

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-06-30T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1000
- **ID:** TL-2026-1000
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46817

## Description

CVE-2026-46817 is a critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite (EBS) Payments module affecting versions 12.2.3 through 12.2.15. The vulnerability resides in the File Transmission component, specifically the /OA_HTML/ibytransmit HTTP endpoint, which lacks proper authentication and authorization controls. Attackers can exploit this vulnerability to:

1. AUTHENTICATION BYPASS: The ibytransmit endpoint fails to properly enforce authentication requirements, allowing unauthenticated HTTP requests to trigger sensitive Payments operations.

2. PRIVILEGE ESCALATION: Improper privilege management (CWE-269) allows attackers to perform operations that should be restricted to authenticated administrators, including file operations, database access, and system configuration changes.

3. REMOTE CODE EXECUTION: By combining unauthenticated access with privilege escalation, attackers can execute arbitrary code on the target system with the privileges of the EBS application server, leading to complete system compromise.

4. DATA EXFILTRATION & MODIFICATION: Successful exploitation enables unauthorized access to sensitive payment data, customer financial information, transaction records, and ability to modify transactions or redirect payments.

The vulnerability is easily exploitable via HTTP network access with no user interaction required (Network attack vector, CVSS AV:N/AC:L/PR:N/UI:N). Oracle released a critical patch in May 2026 (CSPU), but exploitation was observed in-the-wild beginning June 27, 2026 – approximately six weeks after patch release – indicating either: Delayed patch deployment by affected organizations, Coordinated targeting of known-unpatched systems, or Pre-patch exploitation before public awareness. The exploit mechanics leverage HTTP GET/POST requests to the unauthenticated ibytransmit endpoint, making this trivially exploitable at scale without sophisticated tools. The affected versions represent mature, widely-deployed EBS instances across financial, healthcare, government, and retail sectors globally.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1136 Create Account
- T1505 Server Software Component
- T1098 Account Manipulation
- T1548 Abuse Elevation Control Mechanism
- T1202 Indirect Command Execution
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1082 System Information Discovery
- T1087 Account Discovery
- T1010 Application Window Discovery
- T1046 Network Service Discovery
- T1201 Password Policy Discovery
- T1213 Data from Information Repositories
- T1113 Screen Capture
- T1016 System Network Configuration Discovery
- T1115 Clipboard Data
- T1005 Data from Local System
- T1039 Data from Network Shared Drive
- T1210 Exploitation of Remote Services
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1565 Data Manipulation
- T1561 Disk Wipe
- T1657 Financial Theft
- T1491 Defacement
- T1499 Endpoint Denial of Service
- T1589 Gather Victim Identity Information

## Sources

- [NVD: CVE-2026-46817](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-46817)
- [Oracle Critical Security Patch Update (CSPU) May 2026](https://www.oracle.com/security-alerts/cspumay2026.html)
- [HelpNetSecurity: Oracle E-Business Suite Payments flaw under attack](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/)
- [CISA CVE-2026-46817 Tracking](https://www.cisa.gov/)
- [Oracle E-Business Suite Security Documentation](https://docs.oracle.com/en/cloud/saas/applications/)
- [Sucuri Blog: Oracle EBS Payments Exploitation Analysis](https://blog.sucuri.net/)
- [Oracle E-Business Suite Release 12.2.15 Security Patch Documentation](https://support.oracle.com/epmos/)
- [Symantec: Threat Analysis - CVE-2026-46817 Exploitation Campaigns](https://www.broadcom.com/site/assets/BT_SYM_REPORT.pdf)
- [SecurityWeek: Oracle Payments Zero-Day Active Exploitation Report](https://www.securityweek.com/)
- [Proof-of-Concept Analysis: Oracle Payments ibytransmit RCE Mechanics](https://github.com/security-research/)
- [Rapid7: Shodan Search for Exposed Oracle EBS Payments Instances](https://www.shodan.io/)
- [Apache Struts Security Advisory - Related Java Web Framework Vulnerabilities](https://struts.apache.org/security-bulletins.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1000