---
title: "Oracle EBS Payments CVE-2026-46817: Exploited Takeover"
url: https://erroneo.us/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/
description: "Unauthenticated takeover of Oracle Payments in EBS 12.2.3-12.2.15, exploited since June and in CISA KEV. Fixed in the May 2026 CSPU. Patch now."
type: security-brief
section: "Security Digest"
date_published: 2026-05-28
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-46817"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Oracle EBS Payments CVE-2026-46817: Exploited Takeover

**Verdict: Act now.** If you run Oracle E-Business Suite 12.2 without the May 2026 Critical Security Patch Update, patch now; this is an unauthenticated, low-complexity takeover of the payments module and it has been exploited since late June.

- **Who must act:** Every organization running Oracle E-Business Suite 12.2.3 through 12.2.15, most urgently where any EBS web tier is reachable from the internet or from partner networks.
- **Who can relax:** Organizations that do not run Oracle E-Business Suite, and EBS 12.2 customers who already applied the May 2026 CSPU patches for Oracle Payments.
- **Affected:** Oracle Payments (Oracle E-Business Suite) 12.2.3 through 12.2.15; Earlier, unsupported EBS releases are untested; Oracle says they are likely affected
- **Fixed:** Oracle E-Business Suite May 2026 Critical Security Patch Update (released May 28, 2026; see My Oracle Support Note KA923)
- **CVEs:** CVE-2026-46817
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every EBS 12.2 environment, including test and clones that share production data, and confirm whether the May 2026 CSPU EBS patches are applied.
2. Apply the EBS patches from the May 2026 CSPU (My Oracle Support Note KA923), plus the Database and Fusion Middleware patches Oracle recommends for the EBS tech stack.
3. Until patched, take the EBS web tier off the internet or put it behind a VPN, and deny external requests to /OA_HTML/ibytransmit.
4. If an internet-facing instance was unpatched after late June, rotate the APPS and database passwords and any payment-processor or bank credentials stored on the host.
5. Patch CVE-2026-46818, a second Oracle Payments File Transmission bug fixed in the same CSPU, at the same time.

### How to check if you are affected

- Search EBS web-tier access logs for POST requests to /OA_HTML/ibytransmit, especially from outside your network.
- Look for the indicators Beazley Security Labs published: source IP 45.84.137.125, user agent ibytransmit-lab-poc/1.0, and XML DeliveryRequest bodies using CODEX_PULL with FULL_FILE_PATH set to a local file.
- Treat any internet-facing instance left unpatched after May 28 as possibly compromised, and review it before trusting its credentials again.

## What happened

On May 28, 2026, Oracle released its first monthly [Critical Security Patch Update (CSPU)](https://www.oracle.com/security-alerts/cspumay2026.html), a smaller release that sits between the quarterly Critical Patch Updates. One of its 12 E-Business Suite fixes was CVE-2026-46817, a flaw in the File Transmission component of Oracle Payments. Oracle's risk matrix marks it as remotely exploitable over HTTP without authentication and scores it CVSS 3.1 9.8. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-46817) calls it an "easily exploitable vulnerability" that "can result in takeover of Oracle Payments." Oracle published no technical details and credits no reporter for this CVE.

About a month later, on June 29, threat intelligence firm Defused reported that its EBS decoys had recorded "the first in-the-wild exploitation of CVE-2026-46817" on June 27, according to [Help Net Security](https://helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation). Defused described one source running "a targeted proof-of-concept, not broad scanning": an unauthenticated file read through the `ibytransmit` endpoint that pulled `/etc/passwd`. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817) on July 15 and gave federal agencies until July 18. The KEV entry lists improper privilege management, improper authentication and missing authentication as the weaknesses.

This is a different bug from CVE-2025-61882, the BI Publisher zero-day Cl0p used for mass EBS data theft in 2025. That campaign showed how fast EBS flaws turn into extortion.

## Who is affected

Oracle Payments in E-Business Suite 12.2.3 through 12.2.15 is affected, per Oracle's risk matrix and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-46817). Oracle tests only releases under Premier or Extended Support and says earlier versions are "likely" affected too. The required patches are listed in Oracle's EBS Release 12 CSPU Knowledge Document for May 2026 (My Oracle Support Note KA923). Oracle also asks EBS customers to apply the same CSPU to the Database and Fusion Middleware components underneath EBS.

The same release fixed CVE-2026-46818, a second Oracle Payments File Transmission bug (HTTPS, high attack complexity, CVSS 7.4). One patching pass covers both. For scale, [BleepingComputer](https://bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday) cited Shadowserver tracking more than 1,000 internet-exposed EBS instances, over half in the US. It is not known how many of those are patched or are honeypots.

## Do you really need to act?

If you run EBS 12.2 and have not applied the May 2026 CSPU, yes, now. The bug needs no login and no user interaction, the target is the payments module, and exploitation has been public since late June. The activity reported so far is file disclosure. But a file read on an EBS application tier can reach configuration files holding database credentials, encryption keys and payment-processor API keys, a risk both Help Net Security and [Beazley Security Labs](https://labs.beazley.security/advisories/BSL-A1191) point out.

- **EBS web tier reachable from the internet** (supplier or customer portals, remote access without VPN): act now. Treat the instance as possibly compromised if it stayed unpatched after late June.
- **Internal-only EBS:** patch this week. An attacker needs a foothold on your network first. That raises the bar, but not by much.
- **Not using Payments:** Oracle has not said whether instances that don't actively use Oracle Payments are safe. Don't assume they are.
- **No EBS:** nothing to do.

## What to do now

1. List every EBS 12.2 environment, including clones and test systems that hold copies of production data. Check whether the May 2026 CSPU EBS patches are applied, for example by querying `AD_BUGS` for the patch numbers listed in Note KA923.
2. Apply the May 2026 CSPU patches for EBS, plus the Database and Fusion Middleware patches Oracle recommends for the EBS tech stack. Then keep up with Oracle's later monthly and quarterly releases.
3. If patching has to wait, take the EBS web tier off the internet or put it behind a VPN, as Help Net Security and Beazley recommend. At the reverse proxy or WAF, deny external requests to `/OA_HTML/ibytransmit`. Oracle documents no official workaround, so test this first.
4. If an exposed instance was unpatched after late June, rotate the `APPS` and database passwords, wallet contents, and any bank or payment-processor credentials stored on the application tier.

## How to tell if you were hit

Search EBS web-tier access logs for POST requests to `/OA_HTML/ibytransmit`, for example with `grep -r "ibytransmit" <your OHS access log directory>`. Beazley published the indicators from the observed activity: source IP `45.84.137.125`, user agent `ibytransmit-lab-poc/1.0`, and XML `DeliveryRequest` bodies using the `CODEX_PULL` scheme with `FULL_FILE_PATH` pointing at a local file. A missing match does not mean you are clean, because a different actor would use different infrastructure. Any POST to that endpoint from outside your network deserves a closer look. If you find one, follow up with a full forensic review and rotate every credential on the host.

## Timeline

- May 18, 2026 — Oracle reserves CVE-2026-46817.
- May 28, 2026 — Oracle releases the May 2026 CSPU with the fix, and the CVE is published.
- Jun 27, 2026 — Defused's EBS decoys record the first in-the-wild exploitation.
- Jun 29, 2026 — Defused reports the exploitation publicly.
- Jul 15, 2026 — CISA adds CVE-2026-46817 to KEV.
- Jul 18, 2026 — CISA's remediation deadline for federal agencies.

## Sources

1. [Oracle — Critical Security Patch Update Advisory, May 2026](https://www.oracle.com/security-alerts/cspumay2026.html)
2. [CVE record — CVE-2026-46817](https://www.cve.org/CVERecord?id=CVE-2026-46817)
3. [NVD — CVE-2026-46817](https://nvd.nist.gov/vuln/detail/CVE-2026-46817)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-46817](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817)
5. [Beazley Security Labs — BSL-A1191: CVE-2026-46817](https://labs.beazley.security/advisories/BSL-A1191)
6. [Help Net Security — Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)](https://helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation)
7. [BleepingComputer — CISA orders feds to patch actively exploited Oracle flaw by Saturday](https://bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday)

---
Source page: https://erroneo.us/security/briefs/oracle-ebs-payments-cve-2026-46817-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt