CVE-2026-46817 is a critical-severity vulnerability in the File Transmissions component of Oracle E-Business Suite's Payments product. It permits unauthenticated attackers to compromise the Payments system over HTTP, potentially leading to full takeover. Oracle addressed this vulnerability in its May 2026 Critical Security Patch Update, which included fixes for 77 vulnerabilities. Threat intelligence firm Defused reported initial exploitation attempts hitting honeypots shortly after the patch release, though no prior in-the-wild exploitation or public proof-of-concept exploits were known. This vulnerability is part of a pattern of frequent targeting of Oracle E-Business Suite by threat actors.

Successful exploitation allows unauthenticated attackers to take control of the Oracle E-Business Suite Payments product, which could lead to unauthorized transactions, data compromise, and disruption of payment processing. Given the critical severity and the ability to exploit remotely over HTTP without authentication, the impact is high.

Oracle has released an official patch for CVE-2026-46817 as part of its May 2026 Critical Security Patch Update. Organizations should apply this patch immediately to mitigate the vulnerability. There are no indications that the vulnerability is mitigated by default or that no action is required. No public proof-of-concept exploits exist, but exploitation attempts have been observed, underscoring the urgency of patching.