BrevFeed
Sign in
← All stories
● Covered by 1 source · 1 reportHigh impact

Critical Flaw CVE-2026-46817 in Oracle E-Business Suite Exploited

Aggregated by BrevFeed security · updated 93d ago
🔖 Save
New to BrevFeed? We gather this story from every outlet covering it into one summary — ranked by real-world impact, not just the latest headline — so you never miss what matters. What is BrevFeed? →

Key points

  • CVE-2026-46817 has a CVSS score of 9.8.
  • Exploited in the wild, detected on Oracle E-Business honeypots.
  • Impacts Oracle E-Business Suite versions from 12.2.3 to 12.2.15.

Vulnerability Details

CVE-2026-46817 is an improper privilege management and authentication flaw that affects Oracle Payments in the Oracle E-Business Suite. With a CVSS score of 9.8, it allows unauthenticated attackers with network access to potentially takeover compromised instances.

Active Exploitation

Defused Cyber reported that the vulnerability is currently being exploited in the wild, having observed attacks on Oracle E-Business honeypots. Specific exploitation methods or actors behind these attacks are yet to be identified.

Impact and Context

The vulnerability affects Oracle E-Business Suite versions 12.2.3 through 12.2.15, with patches issued by Oracle in their recent Critical Security Patch Update. This ongoing exploitation raises significant security concerns, especially for businesses relying on affected versions.

Related Vulnerabilities

This incident follows earlier vulnerabilities in Oracle products, including CVE-2025-61882, which was utilized in attacks linked to the Cl0p ransomware. Additionally, CVE-2026-35273, a separate authentication flaw in PeopleSoft Suite, has also been recently exploited in data theft operations against companies, including Nissan.

✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →

Keep reading

security Adobe Patches Critical ColdFusion and Campaign Classic Vulnerabilities Amid Exploits 1h ago security CISA Alerts on Active Exploitation of Multiple Microsoft SharePoint Vulnerabilities 4h ago security GitLab RCE PoC Published for Authenticated Users on Unpatched Servers 18d ago security ClickFix Social Engineering Attack Raises Cybersecurity Concerns 1h ago security ShinyHunters Launches New Oracle PeopleSoft Exploitation Campaign Bypassing WAFs 3d ago

The daily brief

One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.

One email a day. Unsubscribe in one click, any time.

Today's brief

Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.

~34 min · 27 stories · Oct 02

▶ Play today's brief Listen on Spotify

New every morning, and the back catalogue is archived by date.

Primary sources

CVE CVE-2025-618829.8 CRITICAL CVE CVE-2026-352739.8 CRITICAL CVE CVE-2026-468179.8 CRITICAL

Reporting from

The Hacker News — Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild 94d ago →

A critical vulnerability in Oracle E-Business Suite, CVE-2026-46817, is now being actively exploited. Impacting versions 12.2.3 to 12.2.15, the flaw allows unauthenticated attackers to take control of Oracle Payments, necessitating immediate patching for affected instances.