Vulnerabilities & Exploits

Oracle Payments Bug Can Leak the Keys Behind It

Oracle Payments is exposed to more than a file leak here. A single unauthenticated request can make Oracle’s own code read server files, so an attacker who reaches the Payments file-transmission path may walk away with configuration data, database credentials, encryption keys, or payment API keys.

Defused says it saw the first in-the-wild exploitation of CVE-2026-46817 on 27 June, about six weeks after Oracle’s May patch and before any public proof of concept. The activity was single-source and targeted, not broad scanning, and it hit Oracle E-Business Suite Payments honeypots running versions 12.2.3 through 12.2.15.

The risk is bigger than the bug itself. If an internet-facing EBS Payments instance was left unpatched, the problem may already have moved past the web tier into the secrets that let attackers reach databases and payment integrations.

7 sources · Jul 10

CVE-2026-46817

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). EPSS 13% (96th percentile).

CISA federal remediation date Jul 18

Timeline

Jul 18 CISA federal deadline for CVE-2026-46817
Jul 15 CVE-2026-46817 added to CISA KEV
Jul 10 Reported by The Register Security
Jul 1 Reported by CyberScoop
Jun 30 Reported by Help Net Security
Jun 29 Reported by BleepingComputer

Sources

Jul 10 The Register Security
Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released
Attackers appear to have reverse-engineered Big Red's patch
original
Jul 1 CyberScoop
Researchers spot exploitation of another critical Oracle defect
The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.
original
Jul 1 Cybersecurity Dive
Critical flaw in Oracle E-Business Suite is under immediate threat
Researchers warn that successful exploitation of the vulnerability could allow an attacker to compromise Oracle Payments.
original

Part of the PlainSec briefing for 2026-06-30

Every edition of this story: Oracle Payments Bug Can Leak the Keys Behind It

More from today

Vulnerabilities & ExploitsOracle Payments Bug Can Leak the Keys Behind ItOracle Payments is exposed to more than a file leak here. A single unauthenticated request can make Oracle’s own code read server files, so an attacker who reaches the Payments file-transmission path may walk away with configuration data, database credentials, encryption keys, or payment API keys.Defused says it saw the first in-the-wild exploitation of CVE-2026-46817 on 27 June, about six weeks after Oracle’s May patch and before any public proof of concept. The activity was single-source and targeted, not broad scanning, and it hit Oracle E-Business Suite Payments honeypots running versions 12.2.3 through 12.2.15.The risk is bigger than the bug itself. If an internet-facing EBS Payments instance was left unpatched, the problem may already have moved past the web tier into the secrets that let attackers reach databases and payment integrations.7 sources · Jul 10

CVE-2026-46817

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). EPSS 13% (96th percentile).

CISA federal remediation date Jul 18

Timeline

Jul 18 CISA federal deadline for CVE-2026-46817

Jul 15 CVE-2026-46817 added to CISA KEV

Jul 10 Reported by The Register Security

Jul 1 Reported by CyberScoop

Jun 30 Reported by Help Net Security

Jun 29 Reported by BleepingComputer

Sources

Jul 10 The Register Security

Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released

Attackers appear to have reverse-engineered Big Red's patch

original

Jul 1 CyberScoop

Researchers spot exploitation of another critical Oracle defect

The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.

original

Jul 1 Cybersecurity Dive

Critical flaw in Oracle E-Business Suite is under immediate threat

Researchers warn that successful exploitation of the vulnerability could allow an attacker to compromise Oracle Payments.

original

Part of the PlainSec briefing for 2026-06-30Every edition of this story: Oracle Payments Bug Can Leak the Keys Behind ItMore from today

Defender Flaw Becomes Ransomware’s Privilege Shortcut

Exposed Langflow Apps Become Network Pivots

AI Pushes Vulnerability Work Past Human Pace