One unauthenticated HTTP request is enough to take over Oracle E-Business Suite's payments module
The patch has existed since May. Exploitation started in July anyway.
CVE-2026-46817 — CVSS 9.8 — improper privilege management in the File Transmission component of Oracle Payments. CISA added it to the KEV catalog July 15 with a federal remediation deadline of July 18.
WHAT ACTUALLY HAPPENED
An unauthenticated attacker with plain HTTP network access to the File Transmission component can take over the system — no credentials, no social engineering, low attack complexity. Oracle shipped the fix in its May 2026 Critical Patch Update. Threat intelligence firm Defused first observed exploitation attempts the weekend of July 11, more than two months after a fix was already available. Successful exploitation hands an attacker control of the application, with direct exposure of payment workflows, financial records, and every enterprise system EBS connects to.
- WHY ERP PATCHING GETS TREATED DIFFERENTLY AND SHOULDN'T
Operating systems and browsers get patched on tight cycles because everyone assumes they are internet-facing and constantly attacked. ERP platforms like E-Business Suite often sit lower on the priority list — treated as internal business software, patched on a quarterly change-control cycle instead of an urgent one. Attackers do not make that distinction. A system that processes payment data is a payment data target, regardless of what category your patch calendar puts it in.
WHAT TO DO NOW
APPLY THE MAY 2026 CRITICAL PATCH UPDATE NOW IF YOU HAVEN'T — a two-month-old patch is not a completed task until it's actually deployed.
RESTRICT INTERNET EXPOSURE OF THE FILE TRANSMISSION ENDPOINT — unauthenticated HTTP access is the entire attack path; removing reachability removes the risk immediately.
AUDIT PAYMENT WORKFLOW LOGS BACK TO JULY 11 — that is the earliest confirmed exploitation window, before CISA's KEV listing made it public.
GIVE ERP PLATFORMS THE SAME PATCH URGENCY AS INTERNET-FACING INFRASTRUCTURE — if it touches payment data, it is not "internal" in any way that matters to an attacker.
A patch sitting unapplied for two months is not a compliance gap. It is a two-month invitation that someone eventually accepted.
Is your ERP patch cycle running on the same urgency tier as your OS and browser patches, or a slower one?