Oracle E-Business Suite Improper Privilege Management Vulnerability

CVE-2026-46817

July 31, 2026 · CISA · Severity: CRITICAL

Oracle E-Business Suite has been identified with a critical vulnerability, CVE-2026-46817, involving improper privilege management. This flaw allows unauthenticated attackers with network access via HTTP to compromise Oracle Payments, potentially leading to a complete takeover of the system. Oracle, the vendor of the affected product, has not yet released a patch for this vulnerability, which has been actively exploited in the wild, as noted in CISA's Known Exploited Vulnerabilities catalog. Organizations using Oracle E-Business Suite, particularly its Oracle Payments module, are at risk of unauthorized access and potential system compromise. The exploitation of this vulnerability could lead to significant operational disruptions, data breaches, and financial losses. Given the active exploitation, CISA urges affected entities to apply mitigations promptly and monitor for updates from Oracle to address this critical security issue.

Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. Vendor: Oracle Product: E-Business Suite CISA Date Added: 2026-07-15 CVE: CVE-2026-46817 This vulnerability is actively exploited in the wild according to CISA Known Exploited Vulnerabilities catalog.

Key Takeaways

CVE-2026-46817 is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog.
The vulnerability involves privilege escalation or authentication bypass, granting unauthorized access to sensitive functions.
CISA BOD 26-04 requires remediation within the specified due date — apply vendor mitigations promptly.
Oracle E-Business Suite: Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments.