CVE-2026-46817

Imagine a mailroom feature in your Payments system that should only accept requests from trusted staff. This flaw lets a stranger send a network request and force the system to open up sensitive files and, in the worst case, take control of the Payments system.

Recent in-the-wild attempts have been reported against the specific HTTP endpoint involved (called ibytransmit), including attempts to read files like /etc/passwd.

This matters if your business runs Oracle E-Business Suite with the Oracle Payments “File Transmission” component on versions 12.2.3–12.2.15.

It’s only a risk if an attacker can reach the vulnerable HTTP endpoint remotely; exploitation attempts are reported without requiring authentication and without user interaction, so exposure on the network is the key gate.

This is RED because attackers are actively probing for and attempting this flaw in the wild, including unauthenticated requests targeting the ibytransmit endpoint. The impact is severe (remote compromise with confidentiality, integrity, and availability damage), so delaying increases the chance of a successful takeover.

Treat remediation as an immediate priority for any environment that matches the affected versions and has the endpoint reachable from untrusted networks.