CISA Warns of Actively Exploited Oracle E-Business Suite Flaw

CISA warns that CVE-2026-46817, an improper privilege management and authentication vulnerability in Oracle E-Business Suite's Oracle Payments component, is being actively exploited in the wild; the flaw allows unauthenticated HTTP attackers to compromise Oracle Payments and potentially expose payment workflows, financial data, and connected systems. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog with an urgent remediation deadline for federal agencies, and organizations are advised to immediately identify affected instances, apply vendor fixes or mitigations, audit logs for suspicious activity, and restrict access while mitigation is implemented.