Back Securityaffairs.Co

Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026

Securityaffairs.Co •Pierluigi Paganini • June 30, 2026

Attackers are exploiting a critical flaw in Oracle E-Business Suite, CVE-2026-46817, that allows remote, unauthenticated attackers to take over Oracle Payments. A critical vulnerability in Oracle E-Business Suite, tracked as CVE-2026-46817, is being actively exploited in the wild, according to cybersecurity firm Defused Cyber. “CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle CSPU May 2026: 35 Critical Vulnerabilities Addressed Oracle released its first Critical Security Patch Update (CSPU) on May 28, 2026, addressing 35 vulnerabilities across multiple product families, including Oracle Database, Oracle REST Data Services, and Oracle E-Business Suite. Among these, CVE-2026-46840 and CVE-2026-34311 are rated critical, with CVSS scores of 10.0 and 9.8, respectively. Attackers can exploit several vulnerabilities remotely without authentication, posing significant risks to organizations using affected Oracle products. The CSPU is part of Oracle's new monthly update strategy, aimed at providing timely security fixes. Security professionals are urged to apply the patches immediately to mitigate risks associated with these vulnerabilities. The update follows a history of exploitation of Oracle vulnerabilities, emphasizing the need for prompt action. 68 sources 72

Extracted Entities

CVEs (1)

CVE-2026-46817

Platforms (2)

Oracle E-business Suite Oracle Payments