OracleExploited incident
Oracle E-Business Suite (Oracle Payments) unauthenticated takeover flaw
CVE-2026-46817Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 15 Jul 2026
- Exploited after a fix existed
Response
- Silence
- same day First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot)CuratedQuote verified
2026-May-28 Rev 1. Initial Release.
Coordinated disclosure: first public information was the May 2026 CSPU.
- Source
- Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0b61ee80a0ddf2d9…- Used in metrics
- Yes
4 more sources for this moment
CVE.org record CVE-2026-46817ClaimedQuote verified28 May 2026, 20:17 UTC
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability
CVE record published.
- Source
- CVE.org record CVE-2026-46817 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:627cd16510f573bf…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet4 Jun 2026, 16:37 UTC
📌 CVE-2026-46817 - Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2... htt
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet29 Jun 2026, 14:15 UTC
Hackers Exploit Oracle E-Business Flaw in Targeted Attacks Hackers are actively exploiting a critical Oracle E-Business flaw, CVE-2026-46817, with a near-perfect CVSS score of 9.8, in targeted
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2026-46817)ClaimedQuote verified15 Jul 2026
Oracle E-Business Suite Improper Privilege Management Vulnerability
Added to CISA's KEV catalog on 2026-07-15.
- Source
- CISA KEV (CVE-2026-46817) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
date onlysame day
Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot)CuratedQuote verified
2026-May-28 Rev 1. Initial Release.
- Source
- Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0b61ee80a0ddf2d9…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date onlysame day
Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot)CuratedQuote verified
Oracle E-Business Suite, versions 12.2.3-12.2.15
Affected-products table of the CSPU released 2026-05-28 (Rev 1); risk matrix row: CVE-2026-46817, Oracle Payments, File Transmission, CVSS 9.8, 12.2.3-12.2.15.
- Source
- Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0b61ee80a0ddf2d9…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot)CuratedQuote verified
2026-May-28 Rev 1. Initial Release.
All supported affected versions (12.2.3-12.2.15) are covered by the one CSPU; patch availability documents are behind My Oracle Support login and were not checked.
- Source
- Oracle Critical Security Patch Update Advisory - May 2026 (Wayback snapshot) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:0b61ee80a0ddf2d9…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- Oracle E-Business Suite (Oracle Payments, File Transmission) 12.2.3-12.2.15
How we built this timeline
Fixed in Oracle's first monthly Critical Security Patch Update (CSPU), released 28 May 2026 (the page notes the initial May CSPU was off the usual third-Tuesday schedule). Exploitation came later: Help Net Security (30 Jun 2026) quotes Defused: 'On 27 June 2026 our Oracle E-Business Suite decoys recorded the first in-the-wild exploitation of CVE-2026-46817 — roughly six weeks after Oracle's May 2026 patch'.
CVSS 9.8 from Oracle's risk matrix. oracle.com blocks non-browser user agents, so a Wayback snapshot is cited; the date quote spans the date and note cells of the Modification History table.