Critical 9.8Known exploited (CISA KEV)Published May 28, 2026

CVE-2026-46817Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Updated under an hour ago (2026-10-19 04:50 UTC)

Does this affect you?

It affects Oracle Corporation Oracle Payments and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Jul 15, 2026; federal agencies had to remediate by Jul 18, 2026. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Oracle Corporation Oracle Payments

Exploited in the last 30 days

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-306, CWE-287, CWE-269
Known exploited: Added to CISA KEV Jul 15, 2026; federal remediation due Jul 18, 2026Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
EPSS (exploitation in the next 30 days): 0.81% (percentile 56)
Assigned by: oracle
NVD analysis: Analyzed
Record last updated: Jul 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Oracle Corporation Oracle Payments oracle:payments (from the name)	from 12.2.3 through 12.2.15	CNA record
oracle e-business_suite oracle:e-business_suite	from 12.2.3 through 12.2.15	NVD

References

https://www.oracle.com/security-alerts/cspumay2026.htmlvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.