Threat actors have started exploiting a critical vulnerability in Oracle E-Business Suite (EBS), threat intelligence firm Defused warns.
Tracked as CVE-2026-46817 (CVSS score of 9.8), the issue was identified in the File Transmissions component of E-Business Suite’s Payments product.
According to Oracle, unauthenticated attackers can exploit the security defect over HTTP to compromise Payments.
“Successful attacks of this vulnerability can result in takeover of Oracle Payments,” Oracle notes.
CVE-2026-46817 was resolved in late May as part of Oracle’s first monthly Critical Security Patch Update (CSPU), which addressed 77 vulnerabilities.
On Monday, Defused warned that the first exploitation attempts against the critical flaw hit its EBS honeypots over the weekend.
The threat intelligence company also points out that there have been no previous reports of the bug’s in-the-wild exploitation and that no public proof-of-concept (PoC) exploit targeting it exists either.
Given the vulnerability’s critical severity and the newly observed attacks, organizations are advised to apply Oracle’s patches as soon as possible. Security defects in E-Business Suite and other Oracle products are regularly targeted in attack campaigns.
In October 2025, the Cl0p ransomware and extortion group exploited a zero-day flaw in the enterprise product to steal data from more than 100 organizations.
In early 2023, threat actors began exploiting a security weakness in E-Business Suite shortly after a PoC was made public.
This month, the infamous extortion group ShinyHunters claimed to have targeted over 100 organizations in a campaign targeting Oracle PeopleSoft, and a handful of victims have already confirmed the impact.
Related: Nissan Employee Data Breached in Oracle PeopleSoft Hack
Related: Oracle’s Second Monthly Security Updates Deliver 245 Patches
Related: Oracle Addresses PeopleSoft Vulnerability Amid Reports of Zero-Day Attacks
Related: Oracle WebLogic Vulnerability Exploited in the Wild
