Oracle EBS Flaw CVE-2026-46817 Exposes Oracle Payments to Takeover

This report describes CVE-2026-46817, a critical (CVSS 9.8) unauthenticated vulnerability in Oracle E-Business Suite Payments File Transmission affecting versions 12.2.3–12.2.15; limited exploitation attempts were observed in late June 2026. It urges immediate application of Oracle's May 2026 CPU, reducing HTTP exposure (VPN/reverse proxy/segmentation), adding targeted monitoring for Payments-related paths (e.g., /OA_HTML/ibytransmit and XML POSTs), and preparing incident response measures for potential takeover of Oracle Payments.