CISA Flags Actively Exploited Oracle E-Business Suite Vulnerability
An improper privilege management flaw in Oracle E-Business Suite is being actively exploited, potentially allowing unauthorized access to Oracle Payments.
CISA has added CVE-2026-46817 to its Known Exploited Vulnerabilities catalog after confirming the flaw is being used in real-world attacks. The vulnerability exists within Oracle E-Business Suite due to improper privilege management, which allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments.
Successful exploitation of this flaw can result in a complete takeover of Oracle Payments. The vulnerability is tied to weakness types CWE-269, CWE-287, and CWE-306.
Federal agencies are required to apply vendor-provided mitigations by July 18, 2026, in accordance with CISA’s BOD 26-04. Organizations should evaluate their assets for internet exposure and follow all relevant patching and forensics triage guidance provided by CISA.
Sources
- CISA KEV Original source
Continue Reading
SecurityNewA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.