CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog on July 15, 2026, confirming active exploitation of a CVSS 9.8 unauthenticated remote code execution vulnerability in Oracle E-Business Suite’s Payments file transmission component. Exploitation was first observed June 27 — roughly six weeks after Oracle’s May 2026 Critical Patch Update — and approximately 950 internet-exposed instances remain unpatched according to Shadowserver telemetry. Finance departments, government procurement systems, and enterprise resource planning environments running Oracle EBS 12.2.x are the primary target profile.
What the Vulnerability Does
CVE-2026-46817 is an unauthenticated remote code execution flaw in Oracle E-Business Suite’s iPayments File Transmission component, reached via the /OA_HTML/ibytransmit endpoint. The endpoint accepts unauthenticated HTTP POST requests carrying XML payloads, and the underlying request-handling logic fails to validate the origin or authorisation of file transmission instructions before processing them.
The attack requires no credentials. An attacker sends a crafted XML payload to the exposed endpoint specifying a remote file path and server address. The Oracle EBS server fetches and processes the attacker-controlled content, resulting in server-side code execution in the context of the Oracle application server process. The attack is one-step: no authentication bypass, no chaining of lower-severity issues, no prior foothold required.
Affected versions span the entire Oracle EBS 12.2 lifecycle in active support:
- Oracle E-Business Suite 12.2.3 through 12.2.15
Oracle 12.1.x is not affected. Cloud-hosted Oracle EBS instances managed through Oracle Cloud receive patches automatically; the exposure window is concentrated among on-premises and self-managed cloud deployments.
Exposure Profile
Shadowserver scans identified approximately 950 Oracle EBS instances with the /OA_HTML/ibytransmit endpoint accessible from the internet at the time CISA added the CVE to its catalog. The real number of vulnerable deployments is higher: many Oracle EBS installations sit behind corporate network perimeters but are accessible to threat actors who have already obtained network-level access via VPN compromise, supply chain implant, or prior phishing.
The finance sector dominates the deployment profile. Oracle EBS runs accounts payable, procurement, payroll, and treasury operations for large enterprises, local authorities, NHS trusts, and central government departments in the UK and across EMEA. Successful exploitation of the Payments module specifically creates pathways to financial transaction manipulation, payment redirection, and access to banking credentials and SWIFT integration configurations stored within EBS.
A confirmed real-world breach attributed to this vulnerability involved Nissan’s payroll processing environment, with threat intelligence from Beazley Security indicating employee payroll data was exfiltrated prior to the CISA KEV listing.
Threat Actor: DriveSurge
Active exploitation has been attributed to DriveSurge, a financially motivated initial access broker with documented relationships to multiple ransomware affiliate groups. DriveSurge’s typical operational pattern is to achieve initial access, establish persistence, perform light reconnaissance to assess the target’s financial size and insurance profile, and then broker access to ransomware operators. Dwell times between DriveSurge access and ransomware deployment in historical incidents range from two to five weeks.
DriveSurge’s targeting of Oracle EBS Payments specifically — rather than more generic EBS attack surfaces — reflects deliberate prioritisation of high-value financial environments. Organisations that discover indicators of compromise consistent with this campaign should treat any Oracle EBS system as potentially pivoted through, not solely the initially compromised host.
Patch Status and Timeline
Oracle released the fix in the May 2026 Critical Patch Update (published May 28, 2026). A supplementary patch addressing edge-case deployment configurations was issued June 16. Both patches are required to fully remediate the vulnerability in affected configurations.
The gap between patch availability and CISA KEV confirmation is six weeks — shorter than many enterprise Oracle patching cycles. Organisations that defer Oracle CPU application by 60–90 days as standard practice were still within their normal window when exploitation began.
Recommended Actions
Patch immediately. Apply the May 2026 Oracle CPU and the June 16 supplementary patch. If patching cannot be completed within 24 hours, treat this as an emergency change.
Restrict endpoint access. If external access to /OA_HTML/ibytransmit is not operationally required, block it at the WAF or perimeter firewall. Many Oracle EBS Payments integrations operate via internal network paths; external exposure of this endpoint should be treated as a misconfiguration in most deployments.
Hunt for indicators of prior compromise. Audit Oracle EBS access logs for unexpected or unauthenticated POST requests to /OA_HTML/ibytransmit. DriveSurge has been observed establishing persistence through Oracle WebLogic session manipulation and scheduled job insertion; these should be included in the scope of any incident response investigation.
Escalate to financial controls. Given the Payments module specificity, notify treasury and accounts payable teams to verify recent payment instructions and look for unauthorised changes to banking detail records within Oracle EBS.
Federal civilian agencies face a mandatory remediation deadline from CISA under BOD 22-01. Commercial organisations with Oracle EBS in scope for PCI DSS or UK FCA regulatory requirements should treat this as a critical finding requiring immediate escalation.