Introduction
CVE-2026-46817 lets an unauthenticated attacker take over Oracle Payments by sending crafted HTTP requests to the File Transmission component. It has a CVSS 3.1 base score of 9.8, with High impact on Confidentiality, Integrity, and Availability. It affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, which covers 13 supported releases and more than a decade of deployments. It also arrives less than a year after the Cl0p/FIN11 threat group mass exploited a nearly identical Oracle EBS flaw (CVE-2025-61882) to breach over 100 organizations.
Technical Information
Vulnerability Overview
CVE-2026-46817 is in the File Transmission component of the Oracle Payments product within Oracle E-Business Suite. It was published to the NVD on May 28, 2026, with the source identifier [email protected]. No CWE ID has been assigned as of the publication date. That limits automated vulnerability classification and may indicate a novel or compound weakness type.
The File Transmission component transfers payment-related files (payment files, bank transmission files, and payment instructions) between Oracle Payments and external systems such as banks and payment processors. That makes it a sensitive interface, and one that is often exposed to network traffic so business partners can connect.
CVSS 3.1 Vector Breakdown
The full CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which gives a base score of 9.8. Each component has a practical consequence for an attacker:
| Vector Component | Value | Implication |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the internet, with no physical or local access needed |
| Attack Complexity (AC) | Low | Minimal technical skill required, and no special conditions must exist |
| Privileges Required (PR) | None | No authentication or credentials of any kind are needed |
| User Interaction (UI) | None | No phishing or social engineering required |
| Scope (S) | Unchanged | Impact is confined to the Oracle Payments component |
| Confidentiality (C) | High | Complete information disclosure, with payment data fully exposed |
| Integrity (I) | High | Complete data modification, so financial records can be altered |
| Availability (A) | High | Complete denial of access to the Oracle Payments service |
Together, AV:N, AC:L, PR:N, and UI:N put this vulnerability in the most dangerous category. Any remote, unauthenticated attacker can exploit it with minimal effort, and nothing depends on what a user does.
Attack Vector and Exploitation Method
The vulnerability is exploitable over HTTP. An attacker with network access can send crafted HTTP requests to the Oracle Payments File Transmission component without providing any credentials. Because the attack needs no authentication, no user interaction, and only low-complexity exploitation, the barrier to entry is minimal.
Once someone develops a proof of concept, attackers could weaponize it for mass scanning and automated exploitation of exposed Oracle EBS instances. That would follow the pattern of the CVE-2025-61882 campaign. Rapid7 described that flaw as an arbitrary file upload vulnerability that enabled unauthenticated remote code execution over HTTP.
Companion Vulnerability: CVE-2026-46818
The same File Transmission component has a second vulnerability, CVE-2026-46818, which is exploitable over HTTPS rather than HTTP. It has a CVSS 3.1 score of 7.4 and High Attack Complexity, so exploitation is more difficult, but it still needs no authentication. Its impacts are High for Confidentiality and Integrity and None for Availability.
For defenders, this means an organization that blocks HTTP at the perimeter but leaves HTTPS exposed might mitigate CVE-2026-46817 while remaining vulnerable to CVE-2026-46818. Address both vulnerabilities at the same time to fully secure the File Transmission component.
Information Gaps
As of the NVD publication date, several technical details are still missing. No CWE classification has been assigned, no specific vulnerability type (e.g., SQL injection, arbitrary file upload, path traversal, deserialization) has been publicly disclosed, and no proof-of-concept code or detailed exploit chain has been published. Without a CWE ID, security tools and frameworks cannot correlate the vulnerability automatically. Understanding the root cause takes a manual review of the Oracle advisory and analysis of the patch.
Threat Context and Exploitation Precedent
No exploitation of CVE-2026-46817 has been confirmed as of its publication date. Its profile still warrants serious concern, given what happened with earlier Oracle EBS flaws.
The Cl0p/FIN11 threat group actively exploited CVE-2025-61882, an earlier Oracle EBS zero-day with the same CVSS 9.8 score and the same unauthenticated HTTP attack profile. CrowdStrike identified a mass exploitation campaign, and Cl0p listed over 100 targeted organizations on its extortion site. Victims included Michelin (over 315GB of data leaked), Madison Square Garden (210GB leaked), and Korean Air. Rapid7 confirmed that the attack used an arbitrary file upload vulnerability to achieve unauthenticated remote code execution over HTTP.
Before that, CVE-2022-21587 (also CVSS 9.8) was exploited in the wild for botnet enrollment. QuorumCyber documented that attackers uploaded a Perl script through an arbitrary file upload vulnerability, and the script then used tools like curl or wget to download additional malicious components. This maps to MITRE ATT&CK technique T1105 (Ingress Tool Transfer) for downloading tools and T1210 (Exploitation of Remote Services) for initial access.
Cl0p/FIN11 operations follow a consistent pattern:
- Discover or acquire zero-day vulnerabilities in enterprise software.
- Mass scan for exposed, unpatched instances.
- Exploit the vulnerabilities to exfiltrate data at scale.
- List victim organizations on the Cl0p extortion site.
- Demand ransom payments under threat of publishing the data.
The group's willingness to invest in Oracle EBS zero-days before disclosure indicates pre-positioned capability and a strategic interest in this product family.
As of May 27, 2026, CISA's most recent KEV additions were three Cisco vulnerabilities (CVE-2026-20122, CVE-2026-20128, CVE-2026-20133), none of them related to Oracle EBS. Organizations should monitor the KEV Catalog for updates on the exploitation status of CVE-2026-46817.
Affected Systems and Versions
The vulnerability affects Oracle Payments within Oracle E-Business Suite versions 12.2.3 through 12.2.15, which is 13 supported versions.
That range covers virtually the entire supported lifecycle of the 12.2.x release train, which indicates the vulnerability has been in the File Transmission component for a long time. Any organization running Oracle EBS 12.2.x that has not applied the May 2026 CSPU should assume it is exposed.
Oracle EBS customers range from small businesses (5.9% of the install base with 0 to 100 employees) to mid-sized firms (27.52% with 101 to 1,000 employees) and large enterprises. Many deployments face the internet so business partners and banks can connect, which expands the attack surface for an HTTP-based vulnerability like this one.
Vendor Security History
Oracle E-Business Suite has had a run of critical, actively exploited vulnerabilities in recent years:
| CVE | CVSS | Year | Exploitation Status | Threat Actor |
|---|---|---|---|---|
| CVE-2022-21587 | 9.8 | 2022 | Exploited in the wild | Unattributed (botnet enrollment) |
| CVE-2025-61882 | 9.8 | 2025 | Actively exploited (zero-day) | Cl0p / FIN11 |
| CVE-2025-61884 | Related | 2025 | Patched alongside CVE-2025-61882 | Same campaign |
| CVE-2026-46817 | 9.8 | 2026 | Not yet confirmed | Under investigation |
Oracle EBS keeps producing CVSS 9.8 unauthenticated HTTP vulnerabilities. That suggests systemic weaknesses in the product's externally facing components, particularly its file handling and transmission interfaces.
Oracle releases a Critical Patch Update (CPU) every quarter and issues out-of-band Critical Security Patch Updates (CSPUs) for urgent vulnerabilities. The May 2026 CSPU contains 35 new security patches across multiple product families, 12 of them for Oracle E-Business Suite alone. That many patches in one product family indicates significant vulnerability discovery activity.
Oracle's advisory warns that attackers have successfully exploited previously patched vulnerabilities when customers failed to apply available patches. Oracle patches promptly, but the product keeps producing serious vulnerabilities, so the primary risk factor is customer patching discipline rather than vendor response time.
References
- NVD: CVE-2026-46817
- Oracle Security Critical Patch Update Advisory, May 2026
- Oracle Security Alerts
- Oracle Security Alert: CVE-2025-61882
- CrowdStrike: Campaign Targeting Oracle E-Business Suite Zero-Day CVE-2025-61882
- Rapid7: Critical 0day in Oracle E-Business Suite Exploited in the Wild
- Tenable: CVE-2025-61882 FAQ, Oracle EBS Zero-Day, Cl0p, and July 2025 CPU
- SecurityWeek: Michelin Confirms Data Breach Linked to Oracle EBS Attack
- QuorumCyber: Exploitation of Critical Vulnerability in Oracle E-Business Suite
- CISA Known Exploited Vulnerabilities Catalog
- CISA Adds Three Known Exploited Vulnerabilities to Catalog (May 27, 2026)
- VulnCheck: Quantifying 2026 Routinely Targeted Vulnerabilities
- Oligo Security: CVE-2025-61882 Oracle EBS Zero-Day in Cl0p Extortion Campaigns
- Strobes: CVE-2025-61882 Explained
