Per CISA, on 15 July 2026 the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-46817 to its Known Exploited Vulnerabilities Catalog, citing active exploitation. The flaw is a CVSS 9.8 improper-privilege-management and authentication weakness in the File Transmission component of Oracle Payments in Oracle E-Business Suite versions 12.2.3 to 12.2.15. An unauthenticated attacker with HTTP access can send a crafted request to the /OA_HTML/ibytransmit endpoint and fully compromise Oracle Payments. Oracle resolved the flaw in late May 2026 as part of its first monthly Critical Security Patch Update (CSPU), replacing the historical quarterly Critical Patch Update cadence.

Shadowserver counted approximately 950 Oracle EBS instances still reachable from the public internet, most of them in the United States. Defused Cyber reported observing an actor exploiting the flaw on its Oracle EBS honeypots, with no known previous exploitation and no public proof-of-concept available at the time of the KEV listing. Separately, a real-world Nissan payroll-data compromise was confirmed as part of a broader campaign involving initial-access brokers, one of which is tracked as DriveSurge. CISA Binding Operational Directive 26-04 pushes federal agencies to rapidly remediate KEV-listed flaws on internet-exposed assets, and the private-sector operating expectation is the same.

Because Oracle EBS is a live financial system of record that holds supplier master data, payment instructions, banking details, payroll files, tax reporting, journal entries, purchase orders and invoicing. Full compromise of the Payments module means an attacker can redirect supplier payments by altering banking details on the supplier master and triggering a payment run, insert unauthorised payment batches sized to sit below reconciliation thresholds, exfiltrate payroll and supplier data covered by the GDPR, and stage extortion based on the credible ability to disrupt payment operations. This is a direct hit on the CFO's revenue cycle, payroll integrity, statutory reporting posture and personal-data breach obligations.

Because the gap between vendor fix and public exploitation has compressed. Oracle moved from a quarterly Critical Patch Update to a monthly Critical Security Patch Update, and CVE-2026-46817 was fixed in the first monthly CSPU in late May 2026 while exploitation was observed on honeypots ahead of the 15 July 2026 KEV listing. A buyer on a quarterly cadence with a next patch window months away would have accepted a live financials system exposed to a known critical flaw. A managed patching cadence, tied by SLA to CISA KEV and Oracle's monthly CSPU, is the operational answer because it amortises the regression-testing capacity across many customers and closes the KEV window in days rather than months.

One, inventory every EBS instance and remove internet exposure of the application, in particular the /OA_HTML/ibytransmit endpoint. Two, contract a managed patching SLA aligned to CISA KEV and Oracle's monthly CSPU, with 7 to 14 days end-to-end for KEV-listed critical severity affecting a component in use. Three, enforce least-privilege on Payments and financial modules with segregation of duties on supplier banking changes and payment approval. Four, cover the EBS application server, database and integration layer with 24/7 monitoring and Managed Detection and Response tuned to exploitation of Payments. Five, run an incident response plan that lists the CFO, treasury, payroll, procurement, external audit and DPO as first-call parties, with a payment-run freeze procedure and a GDPR notification path. Six, require all of the above contractually of any managed-services partner.

Call IT Dev operates as a cybersecurity, managed-services and cloud infrastructure partner for mid-market operators of Oracle E-Business Suite and other legacy ERPs, from Morocco, with nearshore EU-time-zone delivery in English, French, Spanish, Arabic and German, aligned with CNDP Law 09-08 and GDPR. The service covers the six-point playbook end-to-end: EBS inventory and internet-exposure removal, managed patching SLA aligned with CISA KEV and Oracle's monthly CSPU, least-privilege review on Payments and financial modules, 24/7 monitoring and Managed Detection and Response on the EBS stack, incident response readiness with finance in the loop, and contractual accountability for all of the above with monthly evidence.