Security readout for executives and security teams
Plain-English summary
CVE-2026-46817 affects Oracle Payments in Oracle E-Business Suite. An unauthenticated attacker reachable over HTTP can take over the Oracle Payments component. Because CISA lists it as known exploited and the CVSS score is 9.8, exposed systems should be treated as an urgent business risk.
Executive priority
Treat this as a same-day executive escalation for any exposed Oracle Payments environment. The risk is full component takeover, and CISA KEV status means exploitation is not theoretical.
Technical view
Oracle describes an easily exploitable File Transmission flaw in Oracle Payments, affecting supported Oracle E-Business Suite versions 12.2.3 through 12.2.15. The vector is network HTTP, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. Listed CWEs indicate authorization/authentication control failures.
Likely exposure
Organizations running Oracle E-Business Suite with Oracle Payments versions 12.2.3 through 12.2.15 are likely exposed, especially where HTTP access to the application is reachable from untrusted networks.
Exploitation context
CISA KEV status indicates known exploitation. The provided sources do not include exploit details, attacker tooling, or confirmed campaign information, so defenders should avoid assuming a narrow threat profile.
Researcher notes
The source bundle confirms affected range, CVSS vector, KEV status, and CWE categories, but not the exact vulnerable endpoint, patch identifiers, or exploitation mechanics. Validation should remain defensive and source-grounded.
Mitigation direction
- Review Oracle's May 2026 advisory for the exact E-Business Suite remediation guidance.
- Apply the relevant Oracle Payments fixes for affected 12.2.3-12.2.15 systems.
- Restrict untrusted HTTP access to Oracle E-Business Suite while remediation is pending.
- Prioritize internet-facing or partner-accessible Oracle Payments deployments.
- Increase monitoring for Oracle Payments and File Transmission activity.
Validation and detection
- Inventory Oracle E-Business Suite instances and identify Oracle Payments usage.
- Confirm whether versions 12.2.3 through 12.2.15 are present.
- Check patch status against Oracle's May 2026 advisory.
- Map HTTP exposure from internet, VPN, partner, and internal networks.
- Review recent logs for unexpected unauthenticated access patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-46817 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9oracleVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-46817 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-07-15T00:00:00.000Z: CVE-2026-46817 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.