CISA KEV: Oracle E-Business Suite Flaw CVE-2026-46817

Originally published on CyberNetSec.

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability in Oracle E-Business Suite (EBS) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The flaw, tracked as CVE-2026-46817, holds a CVSS score of 9.8 and affects the Oracle Payments component. It enables a remote, unauthenticated attacker to achieve a full system compromise of the module. In response, CISA has issued an emergency directive under BOD 26-04, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary patch by July 18, 2026—a significantly compressed three-day timeline. All organizations using the affected versions are strongly advised to patch immediately and hunt for signs of compromise.

Vulnerability Details

• CVE ID: CVE-2026-46817
• Severity: Critical
• CVSS Score: 9.8 (CVSS v3.1)
• Vulnerability Type: Improper Privilege Management
• Attack Vector: Network (HTTP)
• Prerequisites: None (Unauthenticated)

The vulnerability resides in the Oracle Payments module of the E-Business Suite. An attacker with network access to the application can send a specially crafted HTTP request to exploit the flaw. Successful exploitation grants the attacker complete control over the Oracle Payments component, allowing them to view, modify, or delete sensitive data, and potentially pivot to other connected systems within the enterprise resource planning (ERP) environment.

Affected Systems

The vulnerability impacts the following versions of Oracle E-Business Suite:

• Versions 12.2.3 through 12.2.15

Organizations running any of these versions with the Oracle Payments module exposed to the network are considered highly vulnerable.

Exploitation Status

CISA has confirmed that CVE-2026-46817 is being actively exploited. This assessment is based on a report from threat intelligence firm Defused on June 27, 2026, which observed targeted, unauthenticated file-read attempts against vulnerable systems. The attempts originated from an IP address in Europe. The addition to the KEV catalog on July 16, 2026, solidifies the threat as immediate and ongoing. Ransomware groups like Clop are known to target Oracle EBS, increasing the risk that this vulnerability will be incorporated into wider attack campaigns.

Impact Assessment

A successful exploit of CVE-2026-46817 can have severe consequences, including:

• Data Compromise: Unauthorized access to and exfiltration of sensitive financial data, including customer payment information, transaction histories, and banking details.
• Financial Fraud: The ability to manipulate payment transactions, redirect funds, or create fraudulent payments.
• System Takeover: Complete compromise of the Oracle Payments module, which can serve as a beachhead for lateral movement into other critical ERP and database systems.
• Regulatory Penalties: Non-compliance with data protection regulations such as PCI DSS, GDPR, or SOX due to the exposure of financial information.

Given the unauthenticated nature of the exploit, any internet-facing Oracle EBS instance is at extreme risk.

---

IOCs — Directly from Articles

No specific file hashes, domains, or IP addresses were provided in the source articles for use as IOCs.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Type	Value	Description	Context
url_pattern	OA_HTML/OA.jsp?	Base path for many Oracle EBS web components. Monitor for unusual parameters or requests to this path.	Web server logs, WAF logs
process_name	oacore	The Oracle Application Core Forms and Reports Services process. Monitor for anomalous child processes.	EDR, Host-based logs
log_source	access_log	Oracle HTTP Server access logs. Hunt for unauthenticated requests targeting Payments-related servlets or JSPs.	SIEM, Log management
network_traffic_pattern	Outbound connections from EBS servers	Monitor for unexpected outbound network connections from EBS application servers to unknown IPs.	Firewall logs, Netflow

Detection & Response

Security teams should implement the following detection strategies:

1. Web Log Analysis: Scrutinize web server and application logs for requests targeting Oracle Payments URLs from unknown or suspicious IP addresses. Look for patterns matching the file-read attempts described by Defused. This aligns with D3-NTA: Network Traffic Analysis.
2. Endpoint Monitoring: On EBS application servers, monitor for the spawning of anomalous processes (e.g., cmd.exe, powershell.exe) by the application user account (e.g., applmgr). This indicates potential post-exploitation activity.
3. Configuration Auditing: Regularly audit Oracle EBS configurations to ensure no unauthorized changes have been made to user privileges, payment configurations, or system profiles.

If a compromise is suspected, immediately isolate the affected server from the network, preserve logs and disk images for forensic analysis, and initiate incident response procedures.

Mitigation

1. Immediate Patching: The most critical action is to apply the patch for CVE-2026-46817 provided in the May 2026 Oracle Critical Patch Update (CPU) and subsequent releases. This is a direct application of D3-SU: Software Update.
2. Restrict Network Access: If patching is not immediately possible, restrict all network access to the Oracle E-Business Suite application to only trusted internal IP ranges. Do not expose EBS directly to the internet. This aligns with D3-NI: Network Isolation.
3. Web Application Firewall (WAF): Deploy a WAF with rules designed to inspect and block malicious HTTP requests targeting Oracle EBS. This can serve as a compensating control by filtering attack patterns.
4. Privilege Review: Conduct a thorough review of all accounts and privileges within the Oracle Payments module to ensure adherence to the principle of least privilege.