CVE-2026-46817 is a critical vulnerability in the File Transmission component of Oracle E-Business Suite's Oracle Payments product. It allows unauthenticated attackers with HTTP network access to compromise Oracle Payments and take over vulnerable systems with low attack complexity. Oracle issued security updates in May 2026 to address this issue. Despite the patch availability, active exploitation has been observed in the wild, prompting CISA to mandate federal agencies to patch by July 18, 2026. The vulnerability has a CVSS score of 9.8 and is tracked as actively exploited. Oracle strongly recommends applying patches without delay and staying on actively supported versions.

Successful exploitation of CVE-2026-46817 results in full takeover of Oracle Payments within Oracle E-Business Suite, allowing unauthenticated attackers to compromise financial application components. This poses significant risks to affected organizations, including potential financial fraud, data compromise, and disruption of critical business processes. The vulnerability is actively exploited in the wild, increasing the urgency of remediation.

Oracle released security patches in the May 2026 Critical Security Patch Update to address CVE-2026-46817. Organizations should apply these patches immediately. CISA has mandated U.S. federal agencies to patch vulnerable Oracle EBS instances by July 18, 2026. Oracle advises customers to remain on actively supported versions and not delay patching. No alternative mitigations or workarounds are indicated in the advisory.