CVE-2026-46817
Improper Privilege Management in Oracle E-Business Suite. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 15 July 2026.
- Product
- Oracle E-Business Suite
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.
More from Oracle this year.
- CVE-2026-21962 Improper Access Control, added
- CVE-2026-35273 Missing Authentication for Critical Function, added
- CVE-2024-21182 Unspecified, added
- CVE-2025-61757 Missing Authentication for Critical Function, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.