InfoSecBulletin Cybersecurity for mankind
Attackers are now using a flaw (called CVE-2026-46817) in the Oracle E-Business Suite (EBS) financial app, according to the security firm Defused. This security issue was discovered in the File Transmission part of EBS’s Oracle Payments product. It allows hackers without authentication and with HTTP network access to take over weak systems using simple attacks.
Oracle issued security updates to fix a weakness in its May 2026 Critical Security Patch Update and asked customers to update their systems right away.
Hackers accessed a US defense manufacturer’s Microsoft 365 account via phishing.
Google Play Apps Utilize Stealth Loaders to Spread Anatsa Banking Malware
Bangladeshi org listed “the Gentlemen’ ransomware victim list: CIRT warns
Around 800 Malicious npm Packages Distribute Cross-Platform RAT and Infostealer
Google Chrome 151 Update Fixes 41 Flaws, 6 Critical
Swiss gov.t SharePoint incident compromised 200 accounts
Azad president, Secretary Post Heads to Contest: ISACA Dhaka Chapter Election
Urgent patch! Cisco and IMB patch multiple flaws
OWASP Unveils GenAI LLM Top 10 2026 For Modern AI APPS
Greatness PhaaS Evades Email Security and MFA to Take Over Microsoft 365 Accounts
“Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” the company warned at the time.
“In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay.”
While Oracle has not yet said that the CVE-2026-46817 flaw is being used by attackers, Defused mentioned on Monday that attackers are now using it, with the first attempts seen over the weekend.
“CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being exploited. Over the weekend, we observed an actor exploiting the vulnerability on our Oracle E-Business honeypots. This vulnerability has no known previous exploitation and no public POC code exists,” it warned.
The internet safety group Shadowserver is now watching over 450 Oracle EBS systems that are exposed online, with almost 200 located in the United States and Europe.
There is no information on how many are protected from these attacks.
Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported a serious flaw with Oracle WebLogic Server (CVE-2024-21182) that was fixed two years ago but is still being used in attacks.
Weeks later, the company fixed a serious PeopleSoft Suite zero-day flaw (CVE-2026-35273). This flaw was being used in ShinyHunter data theft attacks and let attackers run code from afar without needing to log in.
