CISA Adds CVE-2026-46817 to KEV List for Oracle E-Business Suite

## Overview CISA added CVE-2026-46817 to its Known Exploited Vulnerabilities (KEV) list on July 15, 2026. This vulnerability impacts the Oracle Payments product within Oracle E-Business Suite. Specifically, it affects versions 12.2.3 through 12.2.15. The addition to the KEV list indicates a federal deadline for remediation due to the risk of exploitation. ## Technical Details CVE-2026-46817 is classified as an improper privilege management vulnerability. An unauthenticated attacker can exploit this flaw with network access via HTTP. The vulnerability allows attackers to compromise Oracle Payments, leading to potential system takeover. The CVSS 3.1 base score is 9.8, highlighting significant risks to confidentiality, integrity, and availability. The CVSS vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). ## Impact Successful exploitation of this vulnerability can result in complete control over Oracle Payments. This could lead to unauthorized transactions, data breaches, and severe financial repercussions for affected organizations. Given the ease of exploitation, the risk is substantial, particularly for organizations using the affected versions of Oracle E-Business Suite. ## Mitigation Organizations using Oracle E-Business Suite versions 12.2.3 to 12.2.15 should prioritize patching their systems. Oracle has released updates to address this vulnerability. Implementing these patches is crucial to protect against potential attacks. Additionally, organizations should review their network configurations and access controls to limit exposure to unauthorized access.