--- title: CISA orders feds to patch actively exploited Oracle flaw... description: CISA has ordered U.S. federal agencies to patch a critical Oracle E-Business Suite vulnerability (CVE-2026-46817, CVSS 9.8) by Saturday, July 18. The flaw,... canonical: https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: CISA orders feds to patch actively exploited Oracle flaw by Saturday | daily.dev og:description: CISA has ordered U.S. federal agencies to patch a critical Oracle E-Business Suite vulnerability (CVE-2026-46817, CVSS 9.8) by Saturday, July 18. The flaw,... og:url: https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci og:image: https://api.daily.dev/og/posts/kDQwicQci.png og:image:alt: CISA orders feds to patch actively exploited Oracle flaw by Saturday og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # CISA orders feds to patch actively exploited Oracle flaw by Saturday **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary CISA has ordered U.S. federal agencies to patch a critical Oracle E-Business Suite vulnerability (CVE-2026-46817, CVSS 9.8) by Saturday, July 18. The flaw, found in the File Transmission component of Oracle Payments, allows unauthenticated attackers with HTTP access to fully compromise vulnerable systems. Oracle released a fix in its May 2026 Critical Security Patch Update, but active exploitation was confirmed by threat intelligence firm Defused on June 29. Shadowserver tracks over 1,000 internet-exposed Oracle EBS instances, more than half in the US. CISA added the flaw to its Known Exploited Vulnerabilities catalog and mandated patching under Binding Operational Directive BOD 26-04. This is the latest in a series of Oracle-related CISA patch mandates, with 43 Oracle vulnerabilities flagged as exploited in the wild over recent years. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-46817 and why is it critical? CVE-2026-46817 is a critical vulnerability (CVSS 9.8) in the File Transmission component of Oracle Payments within Oracle E-Business Suite. It allows unauthenticated attackers with HTTP network access to take over vulnerable systems in low-complexity attacks due to improper privilege management. Oracle patched it in its May 2026 Critical Security Patch Update, but exploitation began by late June with no prior known exploitation or public proof-of-concept. _Teams running Oracle E-Business Suite can track fast-moving exploited CVEs like this one on daily.dev._ ### When do federal agencies have to patch the Oracle E-Business Suite vulnerability CVE-2026-46817? Federal agencies must secure their systems against CVE-2026-46817 by Saturday, July 18, under CISA's Binding Operational Directive 26-04, after the agency added the flaw to its Known Exploited Vulnerabilities catalog. Oracle had already released a fix in its May 2026 Critical Security Patch Update, and Shadowserver tracks over 1,000 internet-exposed Oracle EBS instances, more than half in the United States. _Anyone racing a patch deadline like this can follow CISA directives and Oracle advisories on daily.dev._ ### How many internet-exposed Oracle E-Business Suite instances are vulnerable to attack right now? Shadowserver tracks over 1,000 internet-exposed Oracle E-Business Suite instances, with more than half located in the United States. It is unclear how many of these are honeypots or have already been patched against the actively exploited CVE-2026-46817 vulnerability affecting Oracle Payments. _Security teams assessing exposure to Oracle EBS attacks can stay current on scope and impact via daily.dev._ ## Similar posts on daily.dev - [CISA flags two-year-old Oracle flaw as actively exploited in attacks](https://daily.dev/posts/cisa-flags-two-year-old-oracle-flaw-as-actively-exploited-in-attacks-daetfey5l) · BleepingComputer · 0 upvotes · 0 comments - [CISA orders feds to patch Oracle Identity Manager zero-day](https://daily.dev/posts/cisa-orders-feds-to-patch-oracle-identity-manager-zero-day-yt8nmzwbe) · The Register · 0 upvotes · 0 comments - [Hackers now exploit critical Oracle E-Business flaw in attacks](https://daily.dev/posts/hackers-now-exploit-critical-oracle-e-business-flaw-in-attacks-1agfs2mks) · BleepingComputer · 0 upvotes · 0 comments - [Five New Exploited Bugs Land in CISA's Catalog — Oracle and Microsoft Among Targets](https://daily.dev/posts/five-new-exploited-bugs-land-in-cisa-s-catalog-oracle-and-microsoft-among-targets-m0fauhid0) · The Hacker News · 0 upvotes · 0 comments - [Over 900 Oracle E-Business instances exposed to ongoing attacks](https://daily.dev/posts/over-900-oracle-e-business-instances-exposed-to-ongoing-attacks-fl9ao0jnr) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"CISA orders feds to patch actively exploited Oracle flaw by Saturday","url":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci"},"datePublished":"2026-07-17T00:17:29.864Z","dateModified":"2026-09-14T07:37:51.336Z","description":"CISA has ordered U.S. federal agencies to patch a critical Oracle E-Business Suite vulnerability (CVE-2026-46817, CVSS 9.8) by Saturday, July 18. The flaw,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/77aa2cedb7f135916048a9db37eaaafd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/77aa2cedb7f135916048a9db37eaaafd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"CISA orders feds to patch actively exploited Oracle flaw by Saturday"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday-kdqwicqci#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-46817 and why is it critical?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-46817 is a critical vulnerability (CVSS 9.8) in the File Transmission component of Oracle Payments within Oracle E-Business Suite. It allows unauthenticated attackers with HTTP network access to take over vulnerable systems in low-complexity attacks due to improper privilege management. Oracle patched it in its May 2026 Critical Security Patch Update, but exploitation began by late June with no prior known exploitation or public proof-of-concept. Teams running Oracle E-Business Suite can track fast-moving exploited CVEs like this one on daily.dev."}},{"@type":"Question","name":"When do federal agencies have to patch the Oracle E-Business Suite vulnerability CVE-2026-46817?","acceptedAnswer":{"@type":"Answer","text":"Federal agencies must secure their systems against CVE-2026-46817 by Saturday, July 18, under CISA's Binding Operational Directive 26-04, after the agency added the flaw to its Known Exploited Vulnerabilities catalog. Oracle had already released a fix in its May 2026 Critical Security Patch Update, and Shadowserver tracks over 1,000 internet-exposed Oracle EBS instances, more than half in the United States. Anyone racing a patch deadline like this can follow CISA directives and Oracle advisories on daily.dev."}},{"@type":"Question","name":"How many internet-exposed Oracle E-Business Suite instances are vulnerable to attack right now?","acceptedAnswer":{"@type":"Answer","text":"Shadowserver tracks over 1,000 internet-exposed Oracle E-Business Suite instances, with more than half located in the United States. It is unclear how many of these are honeypots or have already been patched against the actively exploited CVE-2026-46817 vulnerability affecting Oracle Payments. Security teams assessing exposure to Oracle EBS attacks can stay current on scope and impact via daily.dev."}}]} ```