Oracle E-Business Suite: Attacks on Payments Observed

In Oracle's E-Business Suite, attackers can exploit a vulnerability in Oracle Payments to gain full control of the systems. IT security researchers have now observed attacks on this vulnerability in the wild.

The IT researchers from DefusedCyber posted on X on Monday that they have been observing attacks on this security vulnerability in their honeypot systems since the weekend. Until then, no exploitation of the vulnerability or proof-of-concept code was known, explain the IT security researchers. However, DefusedCyber does not provide further details on how the attacks are carried out or their extent. Nothing can be deduced from the snippet of the request shown in the screenshot on X. Therefore, there are also no indicators of compromise (IOCs) that admins could use to scan their systems for traces of attacks.

The security vulnerability allows unauthenticated attackers from the internet, who have HTTP access to vulnerable systems, to exploit a weakness in the file transfer component of Oracle Payments within Oracle E-Business Suite to compromise Oracle Payments. The leak is easy to exploit, Oracle writes in the vulnerability description ( CVE-2026-46817 , CVSS 9.8 , risk “ high ”). Oracle Payments in versions 12.2.3 up to and including 12.2.15 are affected.

Oracle provided a software patch for the security vulnerability on the first “Critical Security Patch Update” (CSPU) in May of this year . However, the overview of Oracle's May patch day does not yet indicate that the security vulnerability is actively being attacked.

The vulnerability is reminiscent of security vulnerabilities in Oracle's E-Business Suite that were heavily attacked in the fall of last year. The perpetrators subsequently extorted ransom from Oracle customers.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.