Emerging Threats

Oracle E-Business Suite Flaw CVE-2026-46817 Sees Active Exploitation

Analyst 207||Source: TheHackerNews
Payment terminal in a brightly-lit retail setting with neutral background.

"Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments," according to a description of the flaw in the NIST National Vulnerability Database (NVD).

CVE-2026-46817 and Oracle Payments

CVE-2026-46817 is tracked as a critical security flaw (CVSS score: 9.8) that the NVD describes as an "improper privilege management and authentication" vulnerability in Oracle Payments. The NVD description warns that successful exploitation "can result in the takeover of Oracle Payments." The flaw specifically affects Oracle E-Business Suite instances that include Oracle Payments.

Active exploitation observed by Defused Cyber

Security firm Defused Cyber reported active exploitation of CVE-2026-46817. According to the company, "over the weekend, we observed an actor exploiting the vulnerability on our Oracle E-Business honeypots." Defused Cyber also noted that "this vulnerability has no known previous exploitation and no public PoC [proof-of-concept] code exists." Beyond the honeypot observations, there are currently no public details about attack techniques, attribution, or whether the incidents reflect an opportunistic scan-and-exploit pattern or a targeted campaign.

Versions affected and Oracle's remediation

The vulnerability impacts Oracle E-Business Suite versions from 12.2.3 through 12.2.15. Oracle shipped patches for the flaw as part of its Critical Security Patch Update last month. Those updates are the vendor-provided remediation for the vulnerability as described in the public reporting.

Historical context inside Oracle E-Business and PeopleSoft

This is not the first time critically rated flaws in Oracle's enterprise suites have been weaponized. Late last year, CVE-2025-61882 (CVSS score: 9.8), a different critical flaw in the E-Business Suite, was "weaponized by threat actors linked to the Cl0p ransomware operation," with early attacks launched as far back as August 2025. Earlier this month, Oracle addressed a critical missing authentication zero-day in PeopleSoft Suite (CVE-2026-35273, CVSS score: 9.8) that was "actively exploited in ShinyHunters data theft and extortion attacks." Those precedents frame CVE-2026-46817 in a recent pattern of high-severity flaws in Oracle products being targeted in the wild.

What this means for technologists, affected enterprises, and adversaries

  • Technologists and security teams: The vulnerability applies to Oracle Payments within E-Business Suite installations running versions 12.2.3–12.2.15, and Oracle has released patches as part of its most recent Critical Security Patch Update. Defused Cyber's honeypot observations confirm active exploitation of the flaw.
  • Affected enterprises and procurement leaders: Organizations that operate Oracle E-Business Suite with Oracle Payments should reconcile their installed versions against the 12.2.3–12.2.15 range identified and note that vendor patches were shipped last month.
  • Adversaries and researchers: Defused Cyber reported no previously known exploitation and no public proof-of-concept code prior to the observed activity; however, the firm documented an actor exploiting the vulnerability on its honeypots "over the weekend," indicating at least some actors have weaponized CVE-2026-46817 in practice.

The immediate facts are straightforward: a critical, high-scoring authentication and privilege-management flaw in Oracle Payments exists (CVE-2026-46817), patches have been published, and online exploitation has been observed on honeypots. What remains to be detailed publicly are the exact exploitation method, the attackers' identities or motives, and whether broader compromise of production systems has occurred. For now, the record links this event to a recent string of high-severity vulnerabilities in Oracle enterprise products that have seen active abuse.

Original reporting: https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html

Active ExploitationEmerging ThreatsNation-StateSupply ChainVulnerability ManagementFinancial SectorCVE-2026-46817Oracle E-Business SuiteOracle PaymentsImproper Privilege Management
Related Intelligence

Continue Reading

Bank interior with teller counters, computers, and papers, hint of digital infrastructure in background.

India's .bank.in Domain Registry Exposes Sensitive Bank Employee Data

A major security slip-up by the registrar for India's .bank.in domain has left 5,576 bank employees' sensitive credentials and contact details exposed, putting their security at risk. This breach undermines the very purpose of the .bank.in namespace - to protect Indian banking web identities from phishers and fraudsters.

Analyst 207
Brightly lit office setting with computer workstation and server room in background.

Nissan Breach Exposes Employee Data After Oracle PeopleSoft Exploit

Nissan confirmed a data breach exposing employee information after a cyberattack exploited a critical vulnerability in Oracle PeopleSoft, part of a larger campaign that may have compromised hundreds of companies. The breach was tied to a specific threat actor targeting Nissan's personnel records.

Analyst 207
Brightly-lit office setting with a large window and subtle tech hint.

ShinyHunters Breach Exposes NAIC's Public Data

The National Association of Insurance Commissioners (NAIC) revealed that a breach exposed its public data after an unauthorized third party exploited a PeopleSoft vulnerability, identified as CVE-2026-35273, tied to the notorious ShinyHunters extortion group. This security issue allowed attackers to gain access to a portion of NAIC's IT systems, compromising sensitive information.

Analyst 207
Laptop on a desk with a Google Chrome browser window open displaying a search engine results page.

Malicious Chrome Extension Exploits Search Functionality for Data Interception

A malicious Chrome extension, masquerading as a popular AI search engine, was discovered to be secretly logging users' searches and address bar inputs, with Microsoft confirming that the data collection was no accident. The extension, since removed by Google, cleverly disguised itself as a legitimate tool, routing queries through an attacker-controlled server.

Analyst 207