Oracle Payments flaw allows unauthenticated takeover

What happened

Oracle has security patches for takeover vulnerabilities in Oracle Application Object Library and Oracle Payments. Think of an office entrance where someone can get inside without showing a badge: these flaws can let an attacker reach an affected application over the network without signing in and take control of it. Both products are affected in versions 12.2.3-12.2.15.

The vendor advisory identifies CVE-2026-101767 in Oracle Application Object Library and CVE-2026-46817 in Oracle Payments. The National Vulnerability Database, or NVD, rates each vulnerability CRITICAL, with a CVSS score of 9.8. Successful exploitation can affect the application's information, its operation and the reliability of its data.

CVE-2026-46817 is known to be exploited. CISA added it to its Known Exploited Vulnerabilities catalog, commonly called KEV, on 2026-07-15, with a listed due date of 2026-07-18. That makes exploitation an established concern for Oracle Payments. The catalog lists known ransomware use as Unknown, which does not establish either involvement or absence of ransomware.

Technical details

The weakness classifications point to failures involving authentication, the process an application uses to establish who is making a request. NVD associates CVE-2026-101767 with CWE-287, Improper Authentication, and CWE-306, Missing Authentication for Critical Function. CVE-2026-46817 has those same classifications and also CWE-269, Improper Privilege Management, which concerns how software assigns or controls permissions. These labels describe weakness categories; they do not establish the exact faulty code or implementation mistake.

For both vulnerabilities, the attacker needs network access to the affected application through HTTP, the protocol used for web requests. The attacker does not need an account or existing privileges, and another user does not need to interact with the attack. NVD describes exploitation as having low complexity. Internet exposure is therefore relevant to reachability, but being publicly accessible is not a stated requirement: the attacker needs a network path to the affected application.

CVSS, the Common Vulnerability Scoring System, summarizes technical severity. Both entries use CVSS 3.1 and have a base score of 9.8. Their assessments indicate high potential impact on confidentiality, meaning keeping information private; integrity, meaning keeping information accurate and protected from unauthorized changes; and availability, meaning keeping the application usable. A severity score describes the vulnerability's characteristics, rather than proving that a particular installation has been compromised.

NVD published CVE-2026-46817 on 2026-05-28 and CVE-2026-101767 on 2026-10-20. The CISA KEV entry establishes known exploitation for CVE-2026-46817; it does not establish exploitation of CVE-2026-101767. The underlying implementation defect and a detailed attack sequence are not specified in these descriptions.

Who is affected

Everyday users

For everyday users, the concern is the business application your organization operates. A takeover of Oracle Application Object Library or Oracle Payments could undermine the privacy, accuracy or availability of information handled by that application. The severity assessment supports those potential consequences, but it does not show that your organization's information has been accessed or changed.

The corrective action belongs with the team maintaining the affected Oracle software. If you use these applications at work, ask that team whether the affected products and versions are present and whether the Oracle security patch has been applied. Changing something in your browser does not apply the server's security patch.

Developers

Developers supporting integrations with Oracle Application Object Library or Oracle Payments should coordinate with the application owners to identify affected installations and plan validation after patching. Because exploitation does not require authentication, an application's normal sign-in requirement should not be treated as evidence that the vulnerable functionality is protected.

The CWE classifications are useful for understanding the problem area, but they are not enough to design a substitute code fix. Use the Oracle security patch as the remediation and follow the update steps in the vendor's advisory. Afterward, exercise the application behavior and integrations your team depends on to check that the update has preserved expected operation.

Server and IT admins

Server and IT administrators should inventory Oracle Application Object Library and Oracle Payments installations running 12.2.3-12.2.15. For Oracle Payments, CVE-2026-46817 carries the additional evidence of known exploitation from CISA KEV. Oracle Application Object Library also needs attention because CVE-2026-101767 has the same critical severity score and permits takeover without an authenticated account.

Plan the work around the Oracle security patch for each affected product. A named fixed release is not specified here, so do not assume that moving to an arbitrary release resolves the issue. Track remediation separately for each affected installation and verify completion against the vendor's advisory.

What to do now

1. Identify installations of Oracle Application Object Library and Oracle Payments, and check whether their versions fall within 12.2.3-12.2.15.
2. Match each affected product to its vulnerability: CVE-2026-101767 for Oracle Application Object Library and CVE-2026-46817 for Oracle Payments.
3. Prioritize patch scheduling with the known exploitation of CVE-2026-46817 in mind, while keeping the critical Oracle Application Object Library patch in scope.
4. Obtain the applicable Oracle security patch and follow the update steps in the vendor's advisory, including any stated preparation and completion requirements.
5. Apply the patch to each affected installation, then confirm both patch status and the operation of the application and its dependent integrations.

If you can't update yet

• If patching must wait, check the vendor advisory for guidance on restricting network access to affected installations and reducing their internet exposure. Treat access restrictions as a temporary measure while arranging the Oracle security patch.

How to confirm the fix

• Use the confirmation procedure in the vendor's advisory to establish that the applicable Oracle security patch was installed successfully.
• Check remediation records for every affected Oracle Application Object Library and Oracle Payments installation. A successful update on one installation does not establish completion elsewhere.
• Validate normal application use and dependent integrations after the update. Functional success helps confirm operation, but patch status must still be verified through the vendor's documented procedure.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-46817 (added July 15, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 2 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Oracle advisory: https://www.oracle.com/security-alerts/cpuoct2026.html
• Oracle advisory: https://www.oracle.com/security-alerts/cspumay2026.html
• NVD: CVE-2026-101767
• NVD: CVE-2026-46817
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on October 30, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.