Oracle E-Business Suite Flaw Under Active Attack, 950 Systems Exposed

Oracle E-Business Suite vulnerability CVE-2026-46817 (affecting Oracle Payments 12.2.3–12.2.15) is reported to be under active attack; researchers warn that the flaw allows unauthenticated remote takeover over HTTP. Shadowserver has identified about 950 internet-facing EBS instances still exposed (mostly in the U.S.), Oracle issued a patch in its recent Critical Patch Update and urges immediate remediation, while technical details and public exploit proof-of-concept remain undisclosed.