Oracle E-Business Suite — CVE-2026-46817

CVE-2026-46817 (CVSS 9.8) is a maximum-severity, unauthenticated remote-code-execution flaw in the File Transmission component of Oracle Payments (iPayment) within Oracle E-Business Suite (EBS). The vulnerable endpoint is /OA_HTML/ibytransmit; an attacker sends a crafted iPayment transmission XML (a <DeliveryRequest> body) that the server processes without authentication, enabling local file read and code execution on the EBS application tier. The flaw requires no authentication, no user interaction, and no prior privileges, and affects EBS versions 12.2.3 through 12.2.15.

Oracle shipped the fix in the May 2026 Critical Patch Update (CPU) on May 28 2026. Real-world exploitation was confirmed over the weekend of June 27–28 2026: honeypot/telemetry observed unauthenticated POST requests to /OA_HTML/ibytransmit carrying crafted XML that attempts to read /etc/passwd and references anomalous CODEX_PULL transmission schemes, from source IP 45.84.137.125 (AS136787 PacketHub S.A.) with the tell-tale User-Agent ibytransmit-lab-poc/1.0.

EBS runs core financials, procurement, HR and payments for large enterprises, so pre-auth RCE on the app tier is a direct data-theft, financial-fraud, and lateral-movement risk — and Oracle EBS has a track record of mass-exploitation (Cl0p-style data theft). The highest-value defensive angles are two: (1) the web-log signature — unauthenticated POSTs to /OA_HTML/ibytransmit, especially with the known UA/IP or /etc/passwd/CODEX_PULL in the XML; and (2) the process anomaly — the EBS app-tier java/oacore service spawning a shell, which no legitimate EBS workflow does.

Defender priority: Confirm every EBS 12.2.3–12.2.15 instance has the May 2026 CPU applied now. In parallel, hunt web/access logs for unauthenticated POST /OA_HTML/ibytransmit (and the atomic IOCs 45.84.137.125 / ibytransmit-lab-poc/1.0), and Falcon process telemetry for the EBS java/oacore service spawning sh/bash. A hit predates the patch — treat as compromise and hunt for persistence and payment-data exfiltration.

The atomic IOCs (45.84.137.125, UA ibytransmit-lab-poc/1.0) are drawn from honeypot / early-PoC telemetry reported by CyberPress — the UA string itself reads like PoC tooling, so treat the IP/UA as early-stage scan-and-exploit indicators that will rotate. The durable detections are the endpoint + payload behavior (unauth POST to ibytransmit, /etc/passwd/CODEX_PULL XML) and the app-tier process anomaly, not the perishable IP/UA.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): Web/access logs show a known-bad indicator — source IP 45.84.137.125 or User-Agent ibytransmit-lab-poc/1.0 — hitting the EBS app tier. T1190
2. H2 (high): An unauthenticated POST reached /OA_HTML/ibytransmit — the vulnerable File Transmission endpoint. T1190
3. H3 (high): A request to ibytransmit carried a crafted iPayment XML referencing /etc/passwd, <DeliveryRequest>, or a CODEX_PULL scheme — the exploitation payload. T1190 / T1005
4. H4 (high): The EBS app-tier java/oacore/adoacorectl process spawned a shell (sh/bash) — RCE / web-shell command execution. T1059
5. H5 (medium): The EBS app-tier process made anomalous outbound connections or launched download tooling (curl/wget/certutil) — exfil, C2, or second-stage staging. T1041 / T1105
6. H6 (medium): New files (web shells, scripts) were written under the EBS OA_HTML/apps tier, or persistence appeared (cron, account) on the host. T1505.003 / T1053 / T1136

Attack chain

⚠ Telemetry reality: Q1–Q3 assume EBS OHS/Apache/proxy access logs are ingested into NGSIEM/LogScale (a custom repo) — replace #repo=ebs_web and the parsed field names (method, url, status, src_ip, http_user_agent) with your ingest's actual values. Q4–Q6 are Falcon endpoint queries that apply wherever a sensor covers the EBS app-tier host.

• OHS/Apache access logs: search every EBS instance's HTTP access logs for requests to /OA_HTML/ibytransmit — especially POSTs from unauthenticated sessions, from 45.84.137.125, or with User-Agent ibytransmit-lab-poc/1.0.
• Payload review: where request bodies are captured (WAF/proxy), inspect ibytransmit requests for iPayment XML containing /etc/passwd, <DeliveryRequest>, or CODEX_PULL transmission schemes.
• Process ancestry review: on the EBS app host, list children of the java/oacore/adoacorectl service since 2026-05-28 — any sh, bash, or network tool is anomalous.
• Patch-state confirmation: confirm each EBS 12.2.x instance has the May 2026 Critical Patch Update applied; flag any lagging instance for emergency patching.
• Filesystem & persistence sweep: check OA_HTML/apps/temp dirs for new scripts or web shells, and the host for new cron entries or local accounts created after disclosure.

Q4 is a strong Custom IOA candidate — the app-tier→shell relationship is deterministic and benign EBS workflows never trigger it. Q1/Q2/Q3 are best run as NGSIEM scheduled searches over ingested access logs; promote Q3 (payload markers) to a Critical alert and keep Q1 (perishable IOCs) as a hunt/enrichment feed.

1 — Grep EBS access logs for ibytransmit exploitation (Linux/OHS)

#!/usr/bin/env bash
# Run on each EBS app node (or over forwarded logs). Flags ibytransmit hits +
# the known UA/IP.
LOGS="${1:-/u01/oracle/*/inst/apps/*/logs/ora/10.1.3/Apache/access_log*}"
grep -Eh '/OA_HTML/ibytransmit' $LOGS 2>/dev/null \
  | grep -E '45\.84\.137\.125|ibytransmit-lab-poc' \
  | tee /tmp/ebs_ibytransmit_hits.txt
echo "[*] $(wc -l < /tmp/ebs_ibytransmit_hits.txt) known-bad ibytransmit hit(s)"

2 — Check patch state & app-tier child processes (Linux)

# Confirm the May 2026 CPU is applied and list shells spawned by the app tier.
# (Run as the EBS owner; adjust ORACLE_HOME / patch id per your environment.)
opatch lsinventory 2>/dev/null | grep -Ei 'May 2026|CVE-2026-46817'
ps -ef | grep -E 'oacore|adoacorectl|weblogic' | grep -v grep
# Any sh/bash whose parent is the app tier is suspicious — inspect its tree.

3 — NGSIEM scheduled-search alert (LogScale) for the payload (Q3)

# Schedule as a recurring search; severity Critical, notify SOC.
#repo=ebs_web
| @rawstring=/ibytransmit/
| @rawstring=/etc\/passwd|CODEX_PULL|DeliveryRequest/

4 — WAF rule sketch (restrict ibytransmit + block the payload)

# ModSecurity-style: block unauth POST payloads that read /etc/passwd or name CODEX_PULL.
SecRule REQUEST_URI "@rx /OA_HTML/ibytransmit" "id:927001,phase:2,chain,deny,status:403,log,\
  msg:'Oracle EBS CVE-2026-46817 ibytransmit exploit'"
  SecRule REQUEST_BODY "@rx (etc/passwd|CODEX_PULL)" "t:none"

Known gaps: the payload query (Q3) only fires where the proxy/WAF captures request bodies or full URIs — many EBS access logs record only the path, so Q2 (endpoint) + Q4 (app-tier shell) are the durable detections. On EBS hosts without a Falcon sensor, Q4/Q5/Q6 do not apply and coverage collapses to ingested web logs — prioritize sensor coverage or log forwarding on the EBS tier. The atomic IP/UA (Q1) are honeypot-derived and will rotate; do not rely on them alone.