CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
Other sources
Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Evaluate the asset’s internet exposure per BOD 26-04 and restrict/discontinue external internet access to the Oracle E-Business Suite (File Transmission) interface exposed via HTTP to reduce unauthenticated network attack reach.
- Compensating control
If vendor mitigations for the Oracle E-Business Suite Improper Privilege Management Vulnerability are unavailable, discontinue use of Oracle E-Business Suite (Oracle Payments component: File Transmission).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46817?
The severity of CVE-2026-46817 is critical with a CVSS score of 9.8.
How do I fix CVE-2026-46817?
To fix CVE-2026-46817, you should apply the latest security patch provided by Oracle for the affected versions of Oracle Payments.
Who can exploit CVE-2026-46817?
CVE-2026-46817 can be exploited by an unauthenticated attacker with network access via HTTP.
What are the affected versions of Oracle Payments for CVE-2026-46817?
The affected versions of Oracle Payments for CVE-2026-46817 are 12.2.3 through 12.2.15.
What components of Oracle E-Business Suite are impacted by CVE-2026-46817?
CVE-2026-46817 impacts the File Transmission component of the Oracle Payments product in Oracle E-Business Suite.