Attackers exploit critical Oracle E-Business Suite flaw weeks after patch, before public exploit code emerged

Summary

Attackers have been actively exploiting a critical vulnerability (CVE-2026-46817, CVSS 9.8) in Oracle E-Business Suite's Payments module just six weeks after Oracle released a patch. Researchers at Defused observed the first exploitation on June 27, targeting the Oracle Payments File Transmission component in releases 12.2.3 through 12.2.15. Notably, the attacks occurred before any public proof-of-concept exploit code was available, suggesting attackers reverse-engineered Oracle's patch to develop their own exploit.

Source

bskyAttackers exploit critical Oracle E-Business Suite flaw weeks after patch, before public exploit code emergedtheregister.com