Oracle E-Business Suite holds the accounting, orders and payments for large organizations. Exactly the kind of system you don't want opening up without a password. CISA says someone is doing it in the real world, which is why it's landed on the actively exploited list.
Fact
The facts: on 15.07.2026, CISA added CVE-2026-46817 to the Known Exploited Vulnerabilities (KEV) catalog - improper access-control handling in Oracle E-Business Suite that lets an unauthenticated attacker with HTTP access compromise the Oracle Payments module, up to full system takeover. It's rated critical (9.8 per NVD). The deadline for US federal agencies is 18.07.2026; if no patch is available, CISA's guidance is to take the product offline. Reported affected versions are 12.2.3-12.2.15. The same day, CVE-2023-4346 also joined the KEV - a hole in the KNX building-automation protocol (CVSS 7.5) with confirmed active exploitation. Source: CISA Known Exploited Vulnerabilities Catalog; Oracle Critical Patch Update.
Here's the catch - the word is 'unauthenticated'. Not 'stolen account'. Not 'insider'. Anyone with network access to the interface can try it, no password needed. Put that on top of a system that moves money, and a CVSS 9.8 stops being an abstract number - it becomes someone else having access to your payments. The three-day deadline CISA gives isn't bureaucracy. It's a measure of how fast this kind of thing burns.
'Unauthenticated' means anyone with network access, no password required. That's why it's three days, not a month.
If you've got Oracle EBS exposed to the outside, the patch doesn't wait until next week. And the rule we keep repeating still stands: 'actively exploited' carries weight only because CISA says so, with a CVE number and a deadline attached. Anyone saying it without a number - that's a rumor.
The visual is generated code-art, no third-party images.