CVE-2026-46817: Critical Unauthenticated File-Read/Takeover Flaw in Oracle E-Business Suite Payments Exploited Pre-PoC

CVE-2026-46817 (TL-2026-1054) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-01 and last reviewed 2026-07-16. It has no confirmed attribution, affects Oracle Oracle E-Business Suite (Oracle Payments - File Transmission, references 1 CVE (CVE-2026-46817), maps to 31 MITRE ATT&CK techniques (T1005, T1021, T1041), and is covered by 0 detection rules and 26 indicators of compromise.

Key facts for TL-2026-1054

Threat ID
TL-2026-1054
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-01
Last reviewed
2026-07-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, finance, manufacturing, retail, government administration, critical-infrastructure
Target regions
North America, Europe
Detection rules
0
Indicators of compromise
26
Updates
2026-07-16 · 4 updates · revalidated 4× · latest source

Malware and tooling in CVE-2026-46817

Malware and tooling: CVE-2026-46817 exploit tooling, Shadowserver Device ID reporting service

A CVSS 9.8 unauthenticated vulnerability in the File Transmission component of Oracle Payments (Oracle E-Business Suite) was exploited in the wild on June 27-28, 2026 — roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed. Defused honeypots recorded six exploitation attempts from a single IP within a two-hour window reading /etc/passwd via the /OA_HTML/ibytransmit endpoint; Shadowserver identified approximately 950 potentially vulnerable, internet-exposed EBS instances, over half in the US.

How CVE-2026-46817 works

CVE-2026-46817 is a critical (CVSS 9.8) flaw in the File Transmission component of Oracle Payments, the payment-processing engine embedded in Oracle E-Business Suite (EBS) that brokers finance-application communication with banks and card networks. The defect combines improper privilege management, improper authentication, and missing authentication for a critical function (CWE-306/CWE-287), allowing an unauthenticated attacker with HTTP network access to compromise and potentially take over the Oracle Payments component with low attack complexity and no user interaction. Affected versions span Oracle E-Business Suite 12.2.3 through 12.2.15. Oracle shipped a fix as part of its May 2026 Critical Patch Update (CPU).

Exploitation targets the /OA_HTML/ibytransmit endpoint (Oracle iPayment's file-transmission handler) via a crafted HTTP POST carrying a text/xml DeliveryRequest payload. The payload sets a CodePackage parameter under the oracle.apps namespace with an EntryPoint that invokes an internal Oracle Java function directly, using a CODEX_PULL transmission scheme whose FULL_FILE_PATH parameter is attacker-controlled, enabling arbitrary file read on the server — a classic authentication-bypass-to-local-file-read exploitation chain that could be leveraged to exfiltrate configuration files, database credentials, encryption keys, or payment-processor API secrets, and plausibly chained toward full system compromise.

On June 27, 2026, threat-intelligence firm Defused observed the first documented in-the-wild exploitation on its Oracle EBS honeypots: five to six file-read attempts against /etc/passwd from a single source IP (45.84.137.125, AS136787 PacketHub S.A., described alternately as EU/France-hosted infrastructure) within roughly a two-hour window (05:38-07:33 UTC). The request tooling self-identified via a distinctive user-agent-like string ("ibytransmit-lab-poc/1.0") that was subsequently re-badged in follow-up attempts, suggesting active tool development. Defused CEO Simo Kohonen assessed the activity as reconnaissance and weaponization testing rather than a targeted campaign against a specific victim, given the single source IP and narrow time window, and noted no public PoC existed at the time of the attempts.

Shadowserver scans conducted June 30, 2026 identified approximately 950 potentially vulnerable, internet-exposed Oracle EBS instances, with more than half located in the United States (other reporting on the same dataset cited a lower, still-rising count near 450-500 as scans continued). The pre-PoC exploitation timing, combined with Oracle EBS's history as a high-value ransomware and data-extortion target — including Cl0p's 2024/2025 mass-exploitation campaign against CVE-2025-61882 and ShinyHunters' PeopleSoft/EBS zero-day data-theft campaigns (CVE-2026-35273, with Nissan confirmed as a victim) — elevates the risk that this reconnaissance activity is a precursor to broader weaponization and follow-on ransomware or extortion operations. Oracle and third-party researchers urge immediate patching, restricting EBS web interfaces to internal/VPN-only access, monitoring for anomalous POST requests to /OA_HTML/ibytransmit, and credential rotation for payment-related service accounts where compromise is suspected.

MITRE ATT&CK techniques used in TL-2026-1054

Collection

T1005 Data from Local System; T1119 Automated Collection; T1213 Data from Information Repositories

Lateral Movement

T1021 Remote Services

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Execution

T1203 Exploitation for Client Execution

Defense Evasion

T1211 Exploitation for Stealth

Impact

T1486 Data Encrypted for Impact; T1565 Data Manipulation; T1657 Financial Theft

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files; T1552.004 Unsecured Credentials: Private Keys; T1606 Forge Web Credentials

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities; T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-46817

  • Oracle — Oracle E-Business Suite (Oracle Payments - File Transmission component)
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: Oracle E-Business Suite with May 2026 Critical Patch Update applied

Remediation for CVE-2026-46817

Patches

  • Oracle Critical Patch Update, May 2026 (CVE-2026-46817)

Immediate actions

  • Apply Oracle's May 2026 Critical Patch Update for E-Business Suite 12.2.3-12.2.15 immediately
  • Restrict Oracle EBS / OA_HTML web interfaces to internal networks or VPN-only access; remove direct internet exposure
  • Block or rate-limit unauthenticated POST requests to /OA_HTML/ibytransmit at the WAF/reverse-proxy layer
  • Rotate credentials, API keys, and secrets for Oracle Payments and any payment-processor integrations if compromise is suspected

Workarounds

  • Disable or restrict access to the ibytransmit / File Transmission functionality within Oracle Payments if patching cannot be applied immediately
  • Place EBS behind a reverse proxy or VPN and deny direct public internet access to /OA_HTML/ endpoints

Longer-term hardening

  • Deploy WAF rules and network segmentation limiting exposure of ERP/finance applications
  • Implement continuous external attack-surface monitoring for EBS instances (Shadowserver-style scanning)
  • Establish logging and alerting baselines for Oracle Payments file-transmission endpoints
  • Adopt a documented Oracle CPU patch-management SLA given EBS's recurring history as a mass-exploitation target

CVEs associated with CVE-2026-46817

CVE-2026-46817

Weaknesses (CWE) in CVE-2026-46817

CWE-306, CWE-287, CWE-269, CWE-22

Timeline of CVE-2026-46817

  • Cl0p-affiliated threat actors begin weaponizing the comparable prior Oracle EBS vulnerability CVE-2025-61882, later confirmed to have impacted Harvard University, University of Pennsylvania, Dartmouth College, University of Phoenix, The Washington Post, Logitech, and GlobalLogic — cited by researchers as a precedent for CVE-2026-46817's risk profile.
  • Oracle releases its May 2026 Critical Patch Update, which includes the fix for CVE-2026-46817 in the Oracle Payments File Transmission component of E-Business Suite.
  • CISA-ADP updates its vulnerability enrichment data referencing CVE-2026-46817.
  • Oracle releases a supplementary June 2026 Critical Security Patch Update addressing related issues in the same Oracle E-Business Suite product line.
  • Five additional file-read attempts against /etc/passwd occur from the same source IP between 07:08 and 07:33 UTC, completing six total exploitation instances within a two-hour window.
  • Defused honeypots record the first in-the-wild exploitation attempt against CVE-2026-46817 at 05:38 UTC, roughly six weeks after the patch was released and before any public proof-of-concept code existed.
  • Shadowserver telemetry records 456 exploitation-related sensor hits against internet-exposed Oracle E-Business Suite instances in a single day, distributed globally: North America (193), Asia (181), Europe (53), South America (18), Africa (9), Oceania (2).
  • Exploitation activity from the single observed source IP (45.84.137.125) ends; no further attempts detected from that source over the following days.
  • BleepingComputer publishes follow-up reporting confirming over 900 Oracle E-Business Suite instances remain exposed to ongoing attacks, with patching status of exposed systems still unknown.
  • Defused publishes research disclosing the pre-PoC exploitation activity; multiple security outlets (BleepingComputer, The Hacker News, SecurityWeek, Help Net Security, SOCRadar) report on the active exploitation.
  • Shadowserver scans identify approximately 950 potentially vulnerable, internet-exposed Oracle E-Business Suite instances (early reporting cited a lower, still-rising figure of over 450, with roughly 200 each in the US and Europe, before the count climbed toward 900-950 as scanning continued).
  • The Shadowserver Foundation, working with Validin's domain-based scanning, reports approximately 900-950 internet-exposed Oracle E-Business Suite instances globally via its public dashboard and Device ID reporting service.
  • CyberScoop publishes follow-up coverage summarizing researcher characterization of the activity as reconnaissance and weaponization testing rather than a targeted campaign.
  • Vulnerability-intelligence tracker Mallory.ai documents CVE-2026-46817 exploitation details publicly, formalizing that in-the-wild exploitation preceded any public proof-of-concept exploit code by roughly five days.
  • CISA adds CVE-2026-46817 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and triggering BOD 26-04 obligations.
  • BleepingComputer reports CISA's order for federal civilian agencies to patch or discontinue affected Oracle EBS instances under BOD 26-04.
  • BOD 26-04 compliance deadline: federal civilian executive branch agencies must have applied mitigations or discontinued use of affected internet-exposed Oracle EBS instances.

Update history for TL-2026-1054

Sources cited for CVE-2026-46817

Threats related to CVE-2026-46817

Detection coverage for TL-2026-1054

As of 2026-07-16, Threadlinqs Intelligence publishes 0 detection rule(s) for TL-2026-1054 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats