Oracle E-Business Suite Improper Privilege Management Vulnerability (CVE-2026-46817)

What is affected, what to do

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Oracle Payments lte 12.2.3..12.2.15

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Establish exposure: Inventory every Oracle E-Business Suite instance on 12.2.3 through 12.2.15, including test, clone and DR environments. Confirm whether the HTTP(S) entry point (Oracle HTTP Server or WebLogic managed servers) is reachable from the internet or from partner networks. Flow Manufacturing (12.2.9+) and Public Sector Financials (12.2.6+) are explicitly in scope.
   • Patch: Apply the Oracle Payments (File Transmission component) fix from the relevant Oracle Critical Patch Update. A patch is available from the vendor; look up the exact patch ID and CPU release in the Oracle advisory or My Oracle Support. Check prerequisites first (AD/TXK code level, adop online patching cycle).
   • Cut external access now: Until the patch is in, block internet access to the EBS web tier at the perimeter, or allow it only through VPN/ZTNA with upstream authentication. Prioritise external iSupplier/iRecruitment DMZ nodes.
   • Assume breach on exposed systems: For internet-facing instances, preserve evidence from the start of exposure (OHS access logs, WebLogic logs, $APPLRGF, database audit trail). Then hunt using the detection rules below.
   • Protect the payment run: Alert accounts payable and treasury. Before the next payment release, use four-eyes verification on recently changed supplier bank accounts and outbound payment files.
   • Rotate credentials if anything looks off: Rotate the APPS/SYSADMIN passwords, the bank transmission credentials (SFTP keys and certificates used by Payments file transmission) and the WebLogic admin passwords.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Put the EBS application tier in a dedicated zone. Allow ingress only from the reverse proxy or WAF. Restrict egress to explicitly required destinations (bank SFTP endpoints, mail relay) and deny everything else, which blocks tool staging and exfiltration.
   • WAF/reverse proxy: Deny external requests to /OA_HTML/ paths tied to Oracle Payments (product prefix iby), or restrict them to known source IPs. Also block oversized POST bodies, XML/XSLT payloads and serialisation patterns aimed at EBS servlets. Prefer an allowlist of externally required responsibilities and URLs over a blocklist.
   • Feature reduction: If Payments file transmission is not used, disable the related functions or servlets, or block them via OHS Location directives. Restrict DMZ nodes with the "External" node trust level.
   • Endpoint hardening: Make EDR mandatory on application-tier hosts. Block, or at least alert on, shell spawns from the WebLogic/Java processes (oacore, oafm, forms). Add file integrity monitoring on $OA_HTML and $COMMON_TOP.
   • IAM/least privilege: Review Payments administrator responsibilities and reduce them to the minimum. Enforce approval workflows for changes to supplier bank accounts and payment process profiles.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs (OHS/proxy): Look for unauthenticated hits on Payments-related paths, for example: index=web host=ebs* uri_path="/OA_HTML/*" (uri_path="*iby*" OR uri_path="*Iby*") | stats count by src_ip, uri_path, status, http_method. Flag external sources, POST bursts, and HTTP 200 responses with no preceding login flow (/OA_HTML/AppsLogin).
   • EDR process ancestry: Watch for the EBS managed-server Java process spawning sh, bash, curl, wget, perl or python. Sigma shape: ParentImage|endswith: '/java' AND Image|endswith: ['/sh','/bash','/curl','/wget'] AND User: applmgr (or your EBS OS user). The auditd equivalent is -a always,exit -F arch=b64 -S execve -F uid=<applmgr-uid>.
   • Network telemetry (Zeek/Suricata): Alert on new outbound connections from the EBS app tier to unapproved destinations, especially HTTP(S) to newly registered domains or reverse-shell patterns on unusual ports. Also flag transfers to bank SFTP targets outside scheduled payment runs.
   • Database/application audit: Watch for unexpected changes to IBY_EXT_BANK_ACCOUNTS, payment process profiles or transmission configuration. Also flag new FND_USER rows or responsibility grants without a change ticket. Enable Unified Auditing on these objects and ship the results to the SIEM.
   • File system: New or modified .jsp, .class or .xsl files under $OA_HTML or WebLogic deployment directories may indicate a webshell. Unknown files in the payment-file output directory are also suspicious.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Source: CISA KEV Catalog, NVD (NIST), CVE.org (MITRE), CSA/SingCERT, pwn.watch, ENISA EUVD, cvelistv5, BSI WID Portal, BSI CSAF

Vendors and products

• Oracle E-business Suite
• Oracle Corporation Oracle Payments

Weakness classes (CWE)

• CWE-306Missing Authentication for Critical Function

  Base

  The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

  Entry at MITRE CWE-306

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

• CWE-269Improper Privilege Management

  Class

  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

  Entry at MITRE CWE-269

References & sources

• oracle.comOracle Advisoryeuvd, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817government-resource
• pwn.watchpwn.watch: Oracle E-Business Suite: Oracle E-Business Suite Improper Privilege Management Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-46817pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 15.07.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-07-15
   Due Date	added	—	2026-07-15
   Required Action	added	—	2026-07-15
   Vulnerability Name	added	—	2026-07-15

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

2. 15.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817
   SSVC assessment	changed	{"id":"CVE-2026-46817","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-05-29T15:41:43.972022Z"}	{"id":"CVE-2026-46817","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-15T17:34:21.994251Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• Critical Flaw in Oracle E-Business Suite is Being ExploitedSANS NewsBites30.06.2026