Researchers spot exploitation of another critical Oracle defect

A critical 9.8-severity vulnerability in Oracle E-Business Suite's payments feature (CVE-2026-46817) is being actively probed by attackers even before public proof-of-concept code was released, indicating sophisticated threat actors are reverse-engineering patches or leveraging private exploit research. Approximately 950 instances remain publicly exposed on the internet, with over half in the United States, creating a large and attractive attack surface. The reconnaissance pattern mirrors the pre-exploitation behavior seen before major Clop ransomware and ShinyHunters extortion campaigns, suggesting a coordinated broader campaign may be imminent. Organizations running Oracle E-Business Suite — particularly those handling payment processing — face significant risk of data theft, extortion, or ransomware if patches are not applied immediately.