Oracle E‑Business Suite exploited within weeks of patch, before any PoC released
Within six weeks of Oracle’s May 2026 patch for CVE‑2026‑46817, attackers were already exploiting the flaw, reverse‑engineering the fix despite no public PoC. The rapid patch‑to‑exploit window shows threat actors can crank up attacks faster than vendors can warn customers, forcing immediate updates.