CVE-2026-46817 active exploitation Defused

First exploitation June 27, 2026 on honeypots. Unauthenticated file-read in Oracle Payments. User-Agent ibytransmit-lab-poc/1.0. Patched in May 2026 CSPU. No public PoC.