Multiple reports say attackers are actively exploiting a critical vulnerability in Oracle E-Business Suite, specifically affecting the Payments component. The issue is tracked as CVE-2026-46817 and has a CVSS score of 9.8, with sources describing it as an authentication and privilege-management weakness that can enable takeover of susceptible Oracle E-Business Suite instances. SecurityWeek, Bleeping Computer, and Help Net Security all cite threat intelligence firm Defused as the basis for their reporting and describe exploitation activity beginning around the end of June 2026. Help Net Security adds timing context from Defused’s observations, stating that decoy systems recorded the first in-the-wild exploitation on 27 June 2026, about six weeks after Oracle’s May 2026 patch. The outlets also report that the activity occurs before any public proof-of-concept was available. Overall, the coverage agrees that exploitation attempts involve unauthenticated access paths and can lead to compromise of affected environments running the vulnerable Payments functionality.