CVE-2026-46817 is a critical vulnerability in the File Transmission component of Oracle Payments within Oracle E-Business Suite. It enables unauthenticated attackers with HTTP network access to take control of affected systems through low-complexity attacks. Over 900 Oracle EBS instances have been found exposed online amid ongoing exploitation attempts detected by threat intelligence sources. Oracle patched this vulnerability in its May 2026 Critical Security Patch Update and recommends immediate application of the fix. While Oracle has not officially confirmed exploitation in the wild, security researchers and monitoring organizations have observed active exploitation attempts and exposed vulnerable systems. This vulnerability is part of a broader pattern of recent critical Oracle product vulnerabilities actively exploited by threat actors.

Successful exploitation of CVE-2026-46817 allows unauthenticated attackers to take over Oracle E-Business Suite systems remotely via HTTP. This can lead to full system compromise, potentially exposing sensitive business and payment data, disrupting operations, and enabling further attacks. The exposure of over 900 vulnerable Oracle EBS instances online increases the attack surface and risk of widespread compromise. The vulnerability is rated critical with a CVSS score of 9.8, indicating high severity and potential impact.

Oracle has released an official security patch for CVE-2026-46817 as part of its May 2026 Critical Security Patch Update. Organizations running Oracle E-Business Suite should immediately apply these security updates to remediate the vulnerability. Since this is not a cloud service, patching must be performed by customers on their on-premises systems. Monitoring exposed Oracle EBS instances and restricting HTTP network access where possible can reduce exposure. Patch status is confirmed as official-fix available from Oracle.