CVE entry · CVE-2026-46817
CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
- Actively exploited: added to CISA’s KEV catalog on July 15, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: July 18, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Oracle E-Business Suite, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
Other Oracle vulnerabilities
-
Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability
-
CVE-2026-35273Used by ransomwareOracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability
-
Oracle WebLogic Server Unspecified Vulnerability
-
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
-
CVE-2025-61884Used by ransomwareOracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerability
-
CVE-2025-61882Used by ransomwareOracle E-Business Suite Unspecified Vulnerability