Here is the cyber version of a “how did they get there already?” moment. Defused researchers say attackers were exploiting a critical Oracle E-Business Suite flaw, CVE-2026-46817, on June 27, before any public proof-of-concept exploit was available. That means the window between patch and weaponized use was not just small. It was smaller than the usual disclosure-to-exploit timeline that many enterprises mentally plan around.

The target was Oracle’s EBS Payments File Transmission component, present in E-Business Suite releases 12.2.3 through 12.2.15. Defused observed what they describe as the first known exploitation of CVE-2026-46817 and reported that the vulnerability was already fixed in Oracle’s May Critical Patch Update. They also tied it to a very high severity profile: CVSS 9.8, and the ability for unauthenticated attackers to read arbitrary files from vulnerable servers.

If you manage risk, this is the part that should tighten your stomach. A critical CVSS 9.8 bug is bad enough. But an unauthenticated file read, in an enterprise payments module, is a fast path to sensitive data exposure. Defused said the requests appeared focused and tactical, not like the scattershot probing that often follows public disclosure of a critical flaw. In their honeypots, they recorded just six exploitation attempts from a single source, and all used what appeared to be a working exploit.

The requests were seeking to retrieve sensitive files from the target system. Defused interpreted that behavior as testing or validation of the technique rather than a broad internet spray. The key sentence, though, is what makes this story bigger than one bug. Defused said exploitation began before any public exploit code had surfaced. That points to an attacker who either reverse-engineered Oracle’s patch quickly or obtained a private exploit. From an enterprise perspective, the details matter less than the implication: “patching” does not necessarily mean “safe,” at least not fast enough to beat actors who move ahead of the public ecosystem.

Zoom out and the pattern starts looking familiar. Earlier this month, researchers warned that attackers had exploited a critical PeopleSoft zero-day before patches were widely deployed, with the ShinyHunters crew claiming to have compromised more than 100 organizations and boasting of having stolen HR and payroll data. The Oracle EBS incident lands in that same neighborhood of “ERP systems are front doors” and “time-to-deploy is the real control.” It also follows Clop’s lengthy campaign against Oracle E-Business Suite customers, disclosed last year after researchers found the ransomware group had targeted internet-facing EBS servers for months before the activity became public. In other words, when the software is mission-critical and often exposed, the economics of cybercrime line up.

There is also a reality check worth putting in front of leadership. Shadowserver Foundation said it currently sees around 950 EBS instances exposed to the public internet, with the majority in the US. Shadowserver also stressed that this figure does not indicate whether those systems are vulnerable or fully patched. That distinction is crucial for decision-makers because it means exposure is not the same as exploitability, but exposure still determines who can reach you at all. Even if only a subset are vulnerable at any moment, the existence of thousands of reachable systems increases the odds that someone with a new working exploit will find a target.

So what is the second-order takeaway for executives and boards? It is not only “another Oracle bug.” It is the reinforcement of a more operational truth: adversaries can compress timelines by targeting privately available information or by reverse-engineering vendor fixes. When enterprises delay deployment windows, attackers do not wait politely for public PoCs. They use private know-how, validate their access, and then scale. For companies running Oracle ERP, the payments module is especially sensitive because it is tied to financial operations, and because file read capabilities can surface credentials, configuration details, or other sensitive material that then fuels broader compromise.

Finally, remember the implied strategic stake. Defused’s observations suggest the exploitation activity was limited in number, but the technique was working. That combination can be worse than noisy scanning because it implies competence and intent, not just opportunism. The Register’s reporting concludes that this probably is not the last Oracle ERP bug to be targeted. Enterprise software has become a lucrative hunting ground, and critical updates can double as roadmaps for actors prepared to reverse-engineer fixes and reach customers before deployment is complete. If you are responsible for cyber risk, the question is no longer whether patches exist. It is whether your patch-to-protection timeline is tight enough to deny attackers the advantage that Defused observed on June 27.