CVE-2026-46817 Exploited on Oracle E-Business Honeypots Days After April CPU Release
Active exploitation of CVE-2026-46817 began within days of Oracle's April CPU despite the absence of public PoC. The incident follows the established pattern of Cl0p and ShinyHunters targeting Oracle enterprise suites with chained authentication flaws that evade standard detection. Rapid post-patch weaponization underscores the need for immediate compromise assessment rather than reliance on patch deployment alone.
The flaw is an unauthenticated privilege-management issue reachable over HTTP that permits full takeover of the Payments module. Oracle shipped fixes in its April CPU; Defused Cyber observed the activity on dedicated honeypots and confirmed no prior exploitation or public code existed. Technical details on the observed payload remain undisclosed.
Procurement records and prior incident timelines show the same product line was targeted by Cl0p affiliates via CVE-2025-61882 starting August 2025. The current case repeats the pattern of rapid post-disclosure weaponization against unpatched 12.2.x instances still common in finance and manufacturing environments.
A parallel zero-day chain in PeopleSoft (CVE-2026-35273) used by ShinyHunters against Nissan demonstrates attackers chaining multiple authentication bypasses and delayed execution via XMLDecoder inside the JVM. Both incidents highlight that observability gaps in Oracle middleware allow persistence without immediate process or network artifacts.
Organizations should treat any internet-facing E-Business Suite instance as potentially compromised until full forensic review of JVM logs, scheduled jobs, and database audit trails confirms no pre-patch access occurred.
Defused Cyber: unique exploitation attempts against Oracle Payments honeypots will surpass 500 distinct source IPs within 45 days of disclosure.
Sources (3)
- [1]NIST NVD CVE-2026-46817(https://nvd.nist.gov/vuln/detail/CVE-2026-46817)
- [2]Defused Cyber Honeypot Report(https://defusedcyber.com/reports/oracle-payments-exploitation-2026)
- [3]Oracle Critical Patch Update April 2026(https://www.oracle.com/security-alerts/cpuapr2026.html)