# CVE-2026-46817: Critical Unauthenticated File-Read/Takeover Flaw in Oracle E-Business Suite Payments Exploited Pre-PoC

> A CVSS 9.8 unauthenticated vulnerability in the File Transmission component of Oracle Payments (Oracle E-Business Suite) was exploited in the wild on June 27-28, 2026 — roughly six weeks after Oracle's May 2026 patch and before any public proof-of-concept existed. Defused honeypots recorded six exploitation attempts from a single IP within a two-hour window reading /etc/passwd via the /OA_HTML/ibytransmit endpoint; Shadowserver identified approximately 950 potentially vulnerable, internet-exposed EBS instances, over half in the US.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-16T11:23:53.756Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1054
- **ID:** TL-2026-1054
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 0 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46817

## Description

CVE-2026-46817 is a critical (CVSS 9.8) flaw in the File Transmission component of Oracle Payments, the payment-processing engine embedded in Oracle E-Business Suite (EBS) that brokers finance-application communication with banks and card networks. The defect combines improper privilege management, improper authentication, and missing authentication for a critical function (CWE-306/CWE-287), allowing an unauthenticated attacker with HTTP network access to compromise and potentially take over the Oracle Payments component with low attack complexity and no user interaction. Affected versions span Oracle E-Business Suite 12.2.3 through 12.2.15. Oracle shipped a fix as part of its May 2026 Critical Patch Update (CPU).

Exploitation targets the /OA_HTML/ibytransmit endpoint (Oracle iPayment's file-transmission handler) via a crafted HTTP POST carrying a text/xml DeliveryRequest payload. The payload sets a CodePackage parameter under the oracle.apps namespace with an EntryPoint that invokes an internal Oracle Java function directly, using a CODEX_PULL transmission scheme whose FULL_FILE_PATH parameter is attacker-controlled, enabling arbitrary file read on the server — a classic authentication-bypass-to-local-file-read exploitation chain that could be leveraged to exfiltrate configuration files, database credentials, encryption keys, or payment-processor API secrets, and plausibly chained toward full system compromise.

On June 27, 2026, threat-intelligence firm Defused observed the first documented in-the-wild exploitation on its Oracle EBS honeypots: five to six file-read attempts against /etc/passwd from a single source IP (45.84.137.125, AS136787 PacketHub S.A., described alternately as EU/France-hosted infrastructure) within roughly a two-hour window (05:38-07:33 UTC). The request tooling self-identified via a distinctive user-agent-like string ("ibytransmit-lab-poc/1.0") that was subsequently re-badged in follow-up attempts, suggesting active tool development. Defused CEO Simo Kohonen assessed the activity as reconnaissance and weaponization testing rather than a targeted campaign against a specific victim, given the single source IP and narrow time window, and noted no public PoC existed at the time of the attempts.

Shadowserver scans conducted June 30, 2026 identified approximately 950 potentially vulnerable, internet-exposed Oracle EBS instances, with more than half located in the United States (other reporting on the same dataset cited a lower, still-rising count near 450-500 as scans continued). The pre-PoC exploitation timing, combined with Oracle EBS's history as a high-value ransomware and data-extortion target — including Cl0p's 2024/2025 mass-exploitation campaign against CVE-2025-61882 and ShinyHunters' PeopleSoft/EBS zero-day data-theft campaigns (CVE-2026-35273, with Nissan confirmed as a victim) — elevates the risk that this reconnaissance activity is a precursor to broader weaponization and follow-on ransomware or extortion operations. Oracle and third-party researchers urge immediate patching, restricting EBS web interfaces to internal/VPN-only access, monitoring for anomalous POST requests to /OA_HTML/ibytransmit, and credential rotation for payment-related service accounts where compromise is suspected.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Vulnerability Scanning
- T1587 Develop Capabilities
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1552.001 Unsecured Credentials: Credentials In Files
- T1606 Forge Web Credentials
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1071.001 Application Layer Protocol: Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1565 Data Manipulation
- T1583 Acquire Infrastructure
- T1087 Account Discovery
- T1078 Valid Accounts
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1592.002 Gather Victim Host Information: Software
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1548 Abuse Elevation Control Mechanism
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1552.004 Unsecured Credentials: Private Keys
- T1657 Financial Theft

## Sources

- [Researchers spot exploitation of another critical Oracle defect](https://cyberscoop.com/oracle-ebs-critical-vulnerability-exploited/)
- [Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)](https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/)
- [Hackers now exploit critical Oracle E-Business flaw in attacks](https://www.bleepingcomputer.com/news/security/new-oracle-e-business-suite-flaw-now-exploited-in-attacks/)
- [Oracle EBS Flaw CVE-2026-46817 Exposes Oracle Payments to Takeover](https://socradar.io/blog/cve-2026-46817-oracle-payments-takeover/)
- [Exploitation of Recent Oracle E-Business Suite Vulnerability Begins](https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/)
- [Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild](https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html)
- [Active Exploitation Alert: Critical Oracle E-Business Suite CVE-2026-46817 Vulnerability Targeting Oracle Payments Module](https://www.rescana.com/post/active-exploitation-alert-critical-oracle-e-business-suite-cve-2026-46817-vulnerability-targeting-oracle-payments-module)
- [CVE-2026-46817 — Unauthenticated file read in Oracle E-Business Suite Payments](https://defusedcyber.com/exploited/cve-2026-46817-oracle-e-business-suite)
- [Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817](https://securityaffairs.com/194463/security/attackers-actively-exploit-the-oracle-e-business-suite-flaw-cve-2026-46817.html)
- [Critical flaw in Oracle E-Business Suite is under immediate threat](https://www.cybersecuritydive.com/news/critical-flaw-oracle-e-business-suite-threat/824230/)
- [Critical Oracle E-Business Suite Flaw Exploited for Unauthenticated Takeover](https://www.mallory.ai/stories/019f145d-1ac9-7852-8dbe-e175dc5ddeb6)
- [Hackers Exploiting Critical Oracle E-Business Suite Vulnerability Actively in Attacks](https://cybersecuritynews.com/oracle-e-business-flaw-actively-exploited/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1054