CVE-2026-46817: Oracle E-Business Suite Payments Unauthenticated RCE (KEV)

Checked: 2026-10-29

CVE-2026-46817 is an improper-privilege-management flaw in the File Transmission component of Oracle Payments, part of Oracle E-Business Suite 12.2.3-12.2.15, that an unauthenticated attacker with network access over HTTP can exploit to fully compromise and take over Oracle Payments, and CISA added it to the Known Exploited Vulnerabilities catalog with a 3-day remediation window.

Vulnerability summary

Vulnerability ID	CVE-2026-46817
CVSS score	9.8
EPSS score	0.1231
CISA KEV	Yes — in the Known Exploited Vulnerabilities catalog
Source	NVD
Published	2026-05-28T21:16:31.503

Affected components

Component	CPE	Version range
Oracle E-Business Suite (Oracle Payments, File Transmission component)	cpe:2.3:a:oracle:e-business_suite::::::::	12.2.3 through 12.2.15

What this means

CVE-2026-46817 affects Oracle Payments, a module within Oracle E-Business Suite (EBS). NVD's description, drawn from Oracle's own advisory, states this is a vulnerability "in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission)" affecting "Supported versions ... 12.2.3-12.2.15" that is "Easily exploitable" and "allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments," where "Successful attacks ... can result in takeover of Oracle Payments" (NVD).

Oracle's own CNA submission, which NVD stores as a Secondary (not NVD-confirmed) metric, scores this CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability. NVD lists three associated weaknesses: CWE-269 (Improper Privilege Management), CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) (NVD).

Oracle's Critical Patch Update advisory for May 2026 lists CVE-2026-46817 in its risk matrix for Oracle E-Business Suite, confirming the same CVSS v3.1 9.8 score and vector, the Oracle Payments / File Transmission component, the affected 12.2.3-12.2.15 version range, and a "Network" attack vector reachable over HTTP without prior authentication (Oracle Critical Patch Update Advisory - May 2026).

CISA added CVE-2026-46817 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-15, with a required-action due date of 2026-07-18 — a 3-day window — and flags the entry for CISA's forensic-triage requirements, while recording knownRansomwareCampaignUse as "Unknown" (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.1231 (96.180th percentile) (FIRST EPSS).

Because the flaw needs no credentials and gives an attacker full takeover of the Oracle Payments module, any Oracle E-Business Suite environment in the 12.2.3-12.2.15 range with Oracle Payments exposed should apply Oracle's May 2026 Critical Patch Update immediately and follow CISA's forensic-triage guidance to check for prior compromise.

How to fix this class of issueThis advisory's weakness class is Authentication bypass. Our practical guide covers how to detect, fix, verify and disclose it: How to fix authentication bypass in embedded firmware.

Evidence

Easily exploitable vulnerability in the Oracle Payments File Transmission component of Oracle E-Business Suite 12.2.3-12.2.15 lets an unauthenticated attacker with HTTP network access compromise and take over Oracle Payments. — NVD
CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted by Oracle's own CNA and stored by NVD as a Secondary (not NVD-confirmed) metric. Associated weaknesses: CWE-269, CWE-287, CWE-306. — NVD
Oracle's May 2026 Critical Patch Update risk matrix confirms CVSS v3.1 9.8, the Oracle Payments / File Transmission component, and the 12.2.3-12.2.15 affected range, reachable over HTTP with no authentication required. — Oracle Critical Patch Update Advisory - May 2026
Added to the CISA Known Exploited Vulnerabilities catalog on 2026-07-15, required action due 2026-07-18 (3-day window), flagged for forensic triage; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
EPSS score is 0.1231 (96.180th percentile) as of 2026-10-29. — FIRST EPSS

More advisories

CVE-2015-5287: Red Hat ABRT Coredump Symlink Privilege EscalationCVE-2015-5287: KEV symlink-attack privilege escalation in Red Hat's Automatic Bug Reporting Tool (ABRT) lets a local attacker gain root via a predictable coredump path. NVD-confirmed 7.8, sourced to NVD, CISA and Red Hat.CVE-2021-23758: Ajax.NET Professional (AjaxPro) Deserialization RCECVE-2021-23758: KEV deserialization-of-untrusted-data flaw in the end-of-life Ajax.NET Professional (AjaxPro) .NET library allows remote code execution. NVD-confirmed 9.8, sourced to NVD, CISA and the project's own fix commit.CVE-2023-4346: KNX Connection Authorization Account-Lockout DoSCVE-2023-4346: KEV overly restrictive account-lockout flaw in the KNX Connection Authorization Option 1 protocol used by building-automation devices, letting an attacker permanently brick a device. Sourced to NVD, CISA ICS-CERT and FIRST EPSS.