EXPOSURES › CVE-2026-46817

CVE-2026-46817

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2026-07-15 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-46817 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 exploited-in-wildunpatchedrce

Oracle E-Business Suite exposed to unauthenticated attacks via HTTP, potentially allowing takeover of Oracle Payments.

An unpatched vulnerability in Oracle E-Business Suite allowed an unauthenticated attacker to compromise Oracle Payments through HTTP, enabling potential takeover. DIB orgs should immediately patch to prevent unauthorized access and data breaches.

Shame score — Unpatched vulnerability enabling unauthenticated takeover of Oracle Payments.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Oracle · vendor E-Business Suite · product

DESCRIPTION

Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.

AFFECTED FEDRAMP PRODUCTS · 10

PRODUCT	PROVIDER	STATUS	MATCH
Aconex for Defense Oracle	Oracle	Authorized	vendor-exact · 0.90
Federal Managed Cloud Services Oracle	Oracle	Authorized	vendor-exact · 0.90
Fusion Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Government Cloud - Common Controls Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Cloud Infrastructure-Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Enterprise Performance Management (EPM) - Moderate Oracle	Oracle	In Process	vendor-exact · 0.90
Oracle Service Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90
Oracle Service Cloud (DOD) Oracle	Oracle	Authorized	vendor-exact · 0.90
Taleo Cloud - U.S. Government Cloud Oracle	Oracle	Authorized	vendor-exact · 0.90