CISA Adds Actively Exploited Oracle E-Business Suite Flaw to KEV
An improper privilege management vulnerability in Oracle E-Business Suite is currently being exploited in the wild, risking full takeover of Oracle Payments.
CISA has added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog, confirming that the flaw is being actively targeted. The vulnerability exists within Oracle E-Business Suite and stems from improper privilege management, categorized under CWE-269, CWE-287, and CWE-306. It allows unauthenticated attackers with network access via HTTP to compromise the Oracle Payments component.
Successful exploitation of this vulnerability can lead to a complete takeover of Oracle Payments. Federal agencies are required to apply vendor-provided mitigations by July 18, 2026, in accordance with CISA’s BOD 26-04. Organizations should evaluate their assets for internet exposure and strictly follow the mandated patching and forensics triage requirements to secure their environments.
Sources
- CISA KEV Original source
Continue Reading
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.