Critical Oracle E-Business Suite Vulnerability Exploited in the Wild Threat actors are actively exploiting CVE-2026-46817, a critical unauthenticated remote takeover vulnerability in Oracle E-Business Suite (EBS), with attacks detected over the weekend of June 27–28, 2026. The flaw, rated 9.8 (CVSS 3.1), resides in the Oracle Payments component, specifically the File Transmission module, and allows attackers with network access via HTTP to fully compromise affected systems impacting confidentiality, integrity, and availability. The vulnerability affects Oracle EBS versions 12.2.3 through 12.2.15, with exploitation requiring no authentication and minimal complexity. Honeypot infrastructure captured attack traffic targeting the /OA_HTML/ibytransmit endpoint, where threat actors delivered a crafted XML DeliveryRequest payload. The attack, originating from IP 45.84.137[.]125 (AS136787, PacketHub S.A., France), used a CODEX_PULL transmission scheme with the FULL_FILE_PATH parameter set to /etc/passwd, indicating an attempt to exfiltrate sensitive system files. Global attack activity peaked on June 28, with 456 detected hits, primarily in North America (193) and Asia (181), followed by Europe (53), South America (18), Africa (9), and Oceania (2). Oracle addressed CVE-2026-46817 in its May 2026 Critical Patch Update (CSPU), released on May 28, 2026, which included fixes for 35 CVEs, 11 of them critical. A follow-up June 2026 CSPU was issued on June 16, 2026, reinforcing patching recommendations. Despite these updates, the absence of a public proof-of-concept (PoC) suggests attackers are using privately developed exploit tooling, heightening risks for unpatched deployments. Key Indicators of Compromise (IOCs): - Attacker IP: 45.84.137[.]125 - Targeted Endpoint: /OA_HTML/ibytransmit - User-Agent: ibytransmit-lab-poc/1.0 - Exploit Payload: CODEX_PULL transmission scheme with /etc/passwd file path