A critical security flaw impacting Oracle E-Business Suite has come under active exploitation in the wild, according to Defused Cyber. The vulnerability, tracked as CVE-2026-46817 (CVSS score: 9.8), refers to an improper privilege management and authentication flaw in Oracle Payments that could be abused to take over susceptible instances.
| Vendor | Product | Versions |
|---|---|---|
| oracle | oracle payments | 12.2.3, 12.2.15 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| oracle | e-business | cert_advisory | 90% |
Updated affected versions to include 12.2.15, marked exploit as available, changed severity to HIGH, and noted no specific IOCs provided.
Updated description with new details on improper privilege management and added tags indicating active exploitation.
Marked exploitAvailable as true, updated patchAvailable to null, and added IoCs from the article.
Updated description with new details about Remote Code Execution and changed exploit availability to false.
Initial creation
