Hackers Target Oracle Payments Flaw CVE-2026-46817

Exploitation attempts targeting a critical vulnerability in Oracle's widely used business software suite have been detected, cybersecurity researchers reported Monday. The activity indicates that attackers are actively targeting the flaw despite it being patched last month.

The vulnerability, tracked as CVE-2026-46817, affects the File Transmission component of Oracle Payments, which is the payment-processing engine built into Oracle's E-Business Suite (EBS). The flaw stems from improper privilege management and missing authentication for a critical function, allowing it to be exploited remotely by unauthenticated attackers with network access via HTTP. Oracle has classified it as easily exploitable.

Threat intelligence firm Defused reported that its honeypot systems recorded the first "in-the-wild" exploitation attempts of this flaw over the weekend of June 27-28. The observed activity involved a single source running an unauthenticated file-read exploit against the Payments component, described as a targeted proof-of-concept rather than broad scanning. The exploit targets the ibytransmit endpoint and can be used to read files from the server, such as the system's /etc/passwd...