CVE Tools
Track your stack

Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild

The Hacker NewsBy The Hacker News

Reported exploitedOracle E-Business Suite

Our summary

Oracle E-Business Suite’s Oracle Payments component is facing a critical actively exploited weakness, tracked as CVE-2026-46817 (CVSS 9.8). The issue involves improper privilege management and authentication that can be abused by a network-based unauthenticated attacker over HTTP to take over affected Oracle Payments instances (versions 12.2.3 through 12.2.15). This matters because it indicates real-world compromise attempts are underway, and organizations should verify they have applied Oracle’s latest security patches.

Read at The Hacker News

The Hacker News publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerOver 900 Oracle E-Business instances exposed to ongoing attacksCVE-2025-61882, CVE-2026-35273 +1
  2. BleepingComputerHackers now exploit critical Oracle E-Business flaw in attacksCVE-2025-61882, CVE-2026-35273 +1
  3. The Hacker NewsThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More StoriesCVE-2026-35273, CVE-2026-46817
  4. Help Net SecurityOracle E-Business Suite Payments flaw under attack (CVE-2026-46817)CVE-2025-61882, CVE-2026-46817
  5. Krebs on SecurityShinyHunters Extorted Boeing Spin-off Prior to Arrests – Krebs on SecurityCVE-2026-35273
  6. Хакер (xakep.ru)Недавний взлом ФБР был связан с компанией-подрядчиком AccentureCVE-2026-35273
  7. The Hacker NewsFBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters BreachCVE-2026-35273
  8. SecurityWeekDutch Police Arrest Convicted Hacker in ShinyHunters InvestigationCVE-2026-35273
  9. The Hacker NewsDutch Police Arrest 24-Year-Old Amsterdam Man in ShinyHunters InvestigationCVE-2026-35273
  10. Krebs on SecurityDutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation – Krebs on SecurityCVE-2026-35273

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure