Vulnerability in the Oracle Payments product of Oracle E-Business Suite

CVE-2026-46817 is a pre-authentication remote takeover in the Oracle Payments product of Oracle E-Business Suite, specifically the File Transmission servlet exposed at /OA_HTML/ibytransmit. A crafted XML DeliveryRequest payload sent over HTTP/HTTPS is enough to compromise confidentiality, integrity and availability of the Payments component without credentials, MFA, or any user interaction. CWE-269 (improper privilege management) plus the unauthenticated network reach is what drives the 9.8. Affected versions span EBS 12.2.3 through 12.2.15 — effectively every supported 12.2 customer.

Oracle's CRITICAL/9.8 label is accurate and we are not adjusting it down. EBS is a tier-1 financial system: it holds the AP/AR ledger, vendor master, banking instructions and EFT/ACH files. The component that took the hit is the one that talks to banks. Combine that blast radius with confirmed in-the-wild exploitation as of 27–28 June 2026 (honeypot hits on /OA_HTML/ibytransmit in NA and APAC) and a private-only exploit in operator hands, and this is a real CRITICAL, not a paper one.

Why this verdict

• Unauthenticated pre-auth RCE-class flaw — PR:N, UI:N, AC:L. The friction audit yields zero credential or interaction barriers. Baseline 9.8 stays.
• Role multiplier: EBS Payments IS the canonical high-value role for this software — there is no "low-value deployment" of Oracle Payments. 100% of installs sit on the financial transaction pipeline. Successful chain = vendor master + bank routing + ACH/EFT file generation in attacker hands. Verdict floor is CRITICAL.
• Active in-the-wild exploitation confirmed 27–28 Jun 2026 across NA and APAC honeypots. Private exploit kit in operator hands; expect commoditization within days.
• Wide affected range (12.2.3–12.2.15) = essentially the entire supported customer base. There is no narrow version window to hide behind.
• Exposure exists in the wild — Shodan/Censys report low-thousands of internet-facing EBS web tiers despite best practice saying it should be internal. Patient zero population is non-zero.

Why not higher?

CRITICAL is already the top severity bucket; nothing to escalate to. We are anchored at the CVSS ceiling of 9.8 because Scope is Unchanged — a Scope:Changed variant (e.g. proven cross-tenant escape from Payments into Financials/HR) would push to 10.0, but Oracle has not published that.

Why not lower?

We cannot drop to HIGH because (a) the chain is fully pre-auth, (b) exploitation is already observed in the wild, and (c) the affected component is by definition a tier-1 financial system. None of the usual downgrade levers (auth required, narrow versions, low-blast-radius role, low exposure) apply. A friction-only downgrade would violate the role-multiplier floor explicitly defined for canonical high-value-role software.

1. Block /OA_HTML/ibytransmit at the WAF/reverse proxy immediately — Drop POST requests to this path from any source not on an explicit treasury/bank-partner allowlist. This is the only known live vector — surgical, low-risk, deployable in under an hour. Do this within the noisgate mitigation SLA of 3 days (target: today).
2. Remove EBS web tier from public internet exposure — If your EBS web tier is reachable from 0.0.0.0/0, place it behind a VPN, ZTNA broker, or partner-only IP allowlist. Use Shodan/Censys to verify your own org's footprint. Same 3-day mitigation window.
3. Apply the May 2026 (or supplementary June 2026) CSPU — This is the actual fix. Schedule the application-tier patch + AD-relink within the noisgate remediation SLA of 90 days, but given active exploitation, treat as immediate — aim for the next change window, not the 90-day backlog.
4. Hunt for IOCs in web access logs — Grep last 90 days of EBS access logs for POST /OA_HTML/ibytransmit with Content-Type: text/xml or application/xml. Any hit not from a known bank-integration source = incident. Engage IR if found.
5. Database auditing on IBY/AP schemas — Enable fine-grained audit on IBY_EXT_BANK_ACCOUNTS, AP_SUPPLIER_SITES_ALL, IBY_PAY_INSTRUCTIONS_ALL. Forward audit trail to SIEM. Detects post-exploit beneficiary tampering even if the initial RCE was missed.

Run on an auditor workstation with network reach to your EBS web tier (HTTPS). Invoke as ./check-cve-2026-46817.sh https://ebs.example.com. Needs no credentials — it fingerprints version banner and probes whether the vulnerable endpoint is reachable. Does NOT send an exploit payload.

#!/usr/bin/env bash
# noisgate verification — CVE-2026-46817 (Oracle EBS Payments File Transmission)
# Safe, non-exploitative check. Exits VULNERABLE / PATCHED / UNKNOWN.
set -u

if [ $# -ne 1 ]; then
  echo "Usage: $0 <https://ebs-host>" >&2
  exit 2
 fi

TARGET="${1%/}"
UA="noisgate-verify/1.0"
TMP=$(mktemp)
trap 'rm -f "$TMP"' EXIT

# 1) Confirm host is Oracle EBS
HTTP_CODE=$(curl -ks -o "$TMP" -w '%{http_code}' -A "$UA" --max-time 10 "$TARGET/OA_HTML/AppsLogin")
if ! grep -qi 'E-Business Suite\|Oracle Applications' "$TMP"; then
  echo "UNKNOWN: target does not look like Oracle EBS (HTTP $HTTP_CODE)"
  exit 3
fi

# 2) Extract version from the AppsLogin / RF.jsp banner if possible
VERSION=$(grep -oE '12\.2\.[0-9]+' "$TMP" | head -1)
if [ -z "$VERSION" ]; then
  curl -ks -o "$TMP" -A "$UA" --max-time 10 "$TARGET/OA_HTML/RF.jsp"
  VERSION=$(grep -oE '12\.2\.[0-9]+' "$TMP" | head -1)
fi

# 3) Probe whether the vulnerable endpoint is reachable (HEAD only, NO payload)
IBY_CODE=$(curl -ks -o /dev/null -w '%{http_code}' -A "$UA" --max-time 10 -X HEAD "$TARGET/OA_HTML/ibytransmit")

echo "Detected EBS version: ${VERSION:-unknown}"
echo "ibytransmit endpoint HTTP code: $IBY_CODE"

# 4) Decision logic
# Affected: 12.2.3 .. 12.2.15 and endpoint reachable (non-404, non-403)
if [ -n "$VERSION" ]; then
  MINOR=${VERSION##12.2.}
  if [ "$MINOR" -ge 3 ] && [ "$MINOR" -le 15 ]; then
    if [ "$IBY_CODE" != "404" ] && [ "$IBY_CODE" != "403" ]; then
      echo "VULNERABLE: version $VERSION in affected range and /OA_HTML/ibytransmit is reachable. Apply May 2026 CSPU or block the endpoint NOW."
      exit 1
    else
      echo "PATCHED-OR-MITIGATED: version $VERSION in affected range but ibytransmit endpoint not reachable ($IBY_CODE). Verify CSPU patch level via adop."
      exit 0
    fi
  else
    echo "PATCHED: version $VERSION outside affected 12.2.3-12.2.15 range."
    exit 0
  fi
fi

echo "UNKNOWN: could not determine EBS version; run adop -status on the apps tier and confirm May 2026 CSPU is applied."
exit 3

Sources

1. Oracle Critical Security Patch Update — May 2026
2. BleepingComputer — Hackers now exploit critical Oracle E-Business flaw
3. Cyber Security News — Oracle E-Business Flaw Actively Exploited
4. NHS England Digital — Exploited Critical Vulnerability in Oracle Payments
5. CSA Singapore — Multiple Critical Vulnerabilities in Oracle Products
6. CCB Belgium — Multiple Vulnerabilities in Oracle Products
7. Tenable plugin 318806 — Oracle EBS May 2026 CSPU
8. CIO — Oracle's first monthly patch release fixes 35 flaws