Attackers are exploiting CVE-2026-46817, a critical Oracle E-Business Suite flaw affecting Oracle Payments, while Shadowserver is tracking roughly 950 internet-facing EBS instances associated with exposure. Teams should verify May 2026 patches, review iPayment endpoint access, and check logs for suspicious file-transmission activity.