E-Business-Suite - CraftedSignal Threat Feed

CVE-2026-46826 - Oracle Payroll Vulnerability Allows Takeover

hello@craftedsignal.io — Thu, 28 May 2026 21:20:42 +0000

CVE-2026-46826 is a critical vulnerability affecting Oracle Payroll, a component of Oracle E-Business Suite. The vulnerability exists within the Internal Operations component and impacts supported versions 12.2.3 through 12.2.15. This easily exploitable vulnerability allows a low-privileged attacker with network access via HTTPS to compromise the Oracle Payroll system. Successful exploitation can lead to a complete takeover of the Oracle Payroll application, posing significant risks to data confidentiality, integrity, and system availability. Organizations using vulnerable versions of Oracle E-Business Suite are at risk.

Attack Chain

Attacker gains low-privileged network access to the Oracle E-Business Suite via HTTPS.
Attacker crafts a malicious HTTPS request targeting the vulnerable Internal Operations component of Oracle Payroll.
The crafted request exploits CVE-2026-46826, bypassing authorization controls due to an input validation flaw.
Successful exploitation allows the attacker to execute arbitrary code within the context of the Oracle Payroll application.
The attacker escalates privileges within the Oracle Payroll application, leveraging exposed APIs or misconfigured roles.
Attacker gains complete control over the Oracle Payroll system.
Attacker can now access, modify, or delete sensitive payroll data, including employee salaries, banking information, and other personal details.
The attacker may install a backdoor or persistence mechanism to maintain unauthorized access to the compromised system for future malicious activities.

Impact

Successful exploitation of CVE-2026-46826 allows a low-privileged attacker to achieve a complete takeover of the Oracle Payroll system. This can lead to significant data breaches, financial losses, and reputational damage. Sensitive payroll data, including employee salaries, banking information, and other personal details, could be exposed or manipulated. The vulnerability affects versions 12.2.3 through 12.2.15 of Oracle E-Business Suite.

Recommendation

Apply the Oracle patch for CVE-2026-46826 to all affected Oracle E-Business Suite installations running Oracle Payroll versions 12.2.3-12.2.15.
Deploy the Sigma rule "Detect CVE-2026-46826 Exploitation Attempt" to your SIEM to identify potentially malicious HTTPS requests targeting the vulnerable component.
Review and restrict network access to the Oracle E-Business Suite to only authorized users and systems.
Implement strong password policies and multi-factor authentication to mitigate the risk of unauthorized access.

CVE-2026-46823 - Oracle Public Sector Financials (International) Unauthorized Data Access

hello@craftedsignal.io — Thu, 28 May 2026 21:20:26 +0000

CVE-2026-46823 is a vulnerability affecting the Authorization component of Oracle Public Sector Financials (International) within Oracle E-Business Suite. The vulnerability impacts versions 12.2.6 through 12.2.15. A low-privileged attacker with network access via HTTPS can exploit this vulnerability to gain unauthorized access to sensitive data. While the vulnerability resides in Oracle Public Sector Financials (International), successful exploitation may significantly impact other Oracle products. This can lead to unauthorized access to critical data or complete access to all Oracle Public Sector Financials (International) accessible data.

Attack Chain

Attacker gains network access to the target Oracle E-Business Suite instance via HTTPS.
Attacker authenticates to the Oracle E-Business Suite with low-privileged credentials.
Attacker crafts a malicious HTTPS request targeting the vulnerable Authorization component within Oracle Public Sector Financials (International).
The crafted request bypasses authorization checks due to the vulnerability in the Authorization component.
The application processes the malicious request without proper authorization, allowing the attacker to access restricted data.
Attacker gains unauthorized read access to sensitive data within Oracle Public Sector Financials (International).
The attacker may leverage this initial access to pivot and compromise other related Oracle products due to the scope change impact.
Attacker exfiltrates sensitive data or uses the unauthorized access to perform other malicious activities within the compromised system.

Impact

Successful exploitation of CVE-2026-46823 can result in unauthorized access to critical data or complete access to all data accessible within Oracle Public Sector Financials (International). While the vulnerability exists within this specific component, the impact may extend to other Oracle products integrated with the E-Business Suite. This could lead to a significant breach of confidentiality, potentially exposing financial records, sensitive government data, or other confidential information.

Recommendation

Apply the Oracle patch for CVE-2026-46823 to remediate the vulnerability in Oracle Public Sector Financials (International).
Deploy the Sigma rule "Detect CVE-2026-46823 Exploitation Attempt - Malicious URI Access" to monitor for exploitation attempts targeting the vulnerable component.
Review and restrict network access to the Oracle E-Business Suite instance, limiting access to authorized users and systems to mitigate the risk of unauthorized access.

CVE-2026-46818 - Unauthenticated RCE in Oracle Payments via File Transmission

hello@craftedsignal.io — Thu, 28 May 2026 21:19:45 +0000

CVE-2026-46818 is a critical vulnerability residing in the File Transmission component of Oracle Payments, a part of the Oracle E-Business Suite. The vulnerability affects versions 12.2.3 through 12.2.15. An unauthenticated attacker with network access via HTTPS can exploit this flaw, gaining unauthorized access to sensitive data and potentially modifying or deleting critical information within the Oracle Payments system. This vulnerability poses a significant risk to organizations using affected versions of Oracle E-Business Suite, as it could lead to data breaches, financial loss, and reputational damage. Successful exploitation grants the attacker unauthorized creation, deletion, or modification access to critical data or complete access to all Oracle Payments accessible data.

Attack Chain

The attacker identifies an Oracle E-Business Suite instance running a vulnerable version of Oracle Payments (12.2.3-12.2.15).
The attacker gains network access to the target system via HTTPS.
The attacker crafts a malicious HTTPS request targeting the File Transmission component.
Due to insufficient access controls or input validation, the attacker's request bypasses authentication.
The vulnerability in the File Transmission component allows the attacker to execute arbitrary code or access sensitive data.
The attacker gains unauthorized access to critical data within Oracle Payments.
The attacker creates, deletes, or modifies data, potentially causing financial loss or disruption of services.
The attacker may escalate privileges or move laterally within the network to further compromise other systems.

Impact

Successful exploitation of CVE-2026-46818 allows an unauthenticated attacker to gain unauthorized access to and modify critical data within Oracle Payments. This can lead to significant data breaches, financial losses, and disruption of financial transactions. The impact could be substantial, potentially affecting thousands of organizations that rely on the Oracle E-Business Suite for payment processing. Data integrity could be compromised, leading to incorrect financial records and legal liabilities.

Recommendation

Apply the latest patch or upgrade to a version of Oracle E-Business Suite that is not affected by CVE-2026-46818, as recommended by Oracle.
Deploy the Sigma rule Detect CVE-2026-46818 Exploitation Attempt via Oracle Payments to identify and block malicious requests targeting the vulnerable File Transmission component.
Monitor network traffic for suspicious HTTPS requests targeting Oracle Payments from untrusted sources, using the network connection log source.
Implement strict access controls to limit network access to Oracle Payments, reducing the attack surface.
Regularly review and audit Oracle Payments configurations to identify and remediate any security weaknesses.

CVE-2026-46824 - Oracle Universal Work Queue Compromise via HTTP

hello@craftedsignal.io — Thu, 28 May 2026 21:18:17 +0000

CVE-2026-46824 is a critical vulnerability affecting the Oracle Universal Work Queue component within Oracle E-Business Suite. Specifically, the vulnerability resides in the Work Provider Site Level Administration. The affected versions are 12.2.3 through 12.2.15. This vulnerability is easily exploitable and grants a low-privileged attacker with network access via HTTP the ability to compromise the Oracle Universal Work Queue. Successful exploitation can lead to a complete takeover of the Oracle Universal Work Queue and may significantly impact other Oracle products within the environment due to a scope change. Defenders should prioritize patching and monitoring for suspicious activity targeting this component.

Attack Chain

Attacker gains low-privileged network access to the Oracle E-Business Suite environment via HTTP.
Attacker sends a crafted HTTP request to the Work Provider Site Level Administration component of the Oracle Universal Work Queue.
The malicious request exploits CVE-2026-46824, bypassing authentication or authorization checks due to insufficient input validation.
Successful exploitation allows the attacker to execute arbitrary code within the context of the Oracle Universal Work Queue application.
The attacker leverages the compromised Universal Work Queue to escalate privileges within the E-Business Suite environment.
Attacker gains control over the Oracle Universal Work Queue application and its data.
Attacker leverages the compromised Oracle Universal Work Queue to pivot and compromise other related Oracle products within the environment.
Attacker achieves complete takeover of the Oracle Universal Work Queue and gains unauthorized access to sensitive data.

Impact

Successful exploitation of CVE-2026-46824 can lead to a complete takeover of the Oracle Universal Work Queue, resulting in unauthorized access to sensitive data, disruption of services, and potential compromise of other Oracle products. The vulnerability allows even low-privileged attackers with network access to achieve significant impact, potentially affecting a wide range of business processes reliant on the Oracle E-Business Suite.

Recommendation

Immediately apply the patch provided by Oracle to address CVE-2026-46824 on all affected Oracle Universal Work Queue instances within the 12.2.3-12.2.15 versions.
Deploy the Sigma rule Detect CVE-2026-46824 Exploitation Attempt via HTTP to detect potential exploitation attempts targeting the vulnerable component using the webserver log source.
Monitor network traffic for suspicious HTTP requests to the Work Provider Site Level Administration component of the Oracle Universal Work Queue.

CVE-2026-46822 - Oracle iAssets Remote Code Execution Vulnerability

hello@craftedsignal.io — Thu, 28 May 2026 21:18:04 +0000

CVE-2026-46822 is a critical vulnerability affecting Oracle iAssets, a component of the Oracle E-Business Suite. The vulnerability resides within the 'Internal Operations' component and impacts versions 12.2.3 through 12.2.15. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle iAssets. Successful exploitation could lead to a complete takeover of Oracle iAssets, potentially cascading to other products within the E-Business Suite environment. Given the ease of exploitation and the potential for significant impact, this vulnerability poses a serious risk to organizations using affected versions of Oracle iAssets.

Attack Chain

The attacker gains low-privileged network access to the Oracle E-Business Suite via HTTP.
The attacker crafts a malicious HTTP request targeting the vulnerable 'Internal Operations' component of Oracle iAssets.
The crafted request exploits CVE-2026-46822, bypassing authentication or authorization checks due to a flaw in input validation or session management.
The vulnerability allows the attacker to inject arbitrary code or commands into the application.
The injected code is executed within the context of the Oracle iAssets application server.
The attacker leverages the initial foothold to escalate privileges within the iAssets application.
The attacker gains complete control over the Oracle iAssets application and its associated data.
The attacker pivots from the compromised iAssets application to other products within the Oracle E-Business Suite environment, potentially gaining access to sensitive data or disrupting business operations.

Impact

Successful exploitation of CVE-2026-46822 can lead to a complete takeover of the Oracle iAssets application. This grants the attacker full control over sensitive asset data, financial records, and other critical information managed by iAssets. Furthermore, the attacker can potentially pivot to other applications within the Oracle E-Business Suite environment, leading to a broader compromise of the organization's IT infrastructure and business operations. The CVSS 3.1 score of 9.9 reflects the high confidentiality, integrity, and availability impacts of this vulnerability.

Recommendation

Immediately apply the security patch provided by Oracle to address CVE-2026-46822 on all affected Oracle iAssets instances (versions 12.2.3-12.2.15).
Deploy the Sigma rule "Detect CVE-2026-46822 Exploitation Attempts - HTTP Request" to identify exploitation attempts against the vulnerable 'Internal Operations' component.
Implement network segmentation and access control policies to restrict network access to the Oracle E-Business Suite environment, mitigating the risk of unauthorized access and lateral movement.
Monitor web server logs for suspicious HTTP requests targeting the Oracle iAssets application, looking for indicators of exploitation attempts.

CVE-2026-34275 - Oracle Advanced Inbound Telephony Unauthenticated Remote Code Execution

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

CVE-2026-34275 is a critical vulnerability affecting Oracle Advanced Inbound Telephony (AIT) versions 12.2.3 through 12.2.15. This vulnerability, residing within the Setup and Administration component, allows an unauthenticated attacker with network access via HTTP to remotely compromise the Oracle AIT application. Successful exploitation can lead to a complete takeover of the Oracle AIT system, granting the attacker full control over the application and potentially the underlying server. Due to the nature of the affected component, exploitation requires no prior authentication, making it easily exploitable. This poses a significant risk to organizations using vulnerable versions of Oracle E-Business Suite, as it could lead to unauthorized access, data breaches, and disruption of telephony services.

Attack Chain

Attacker identifies a vulnerable Oracle Advanced Inbound Telephony instance (versions 12.2.3-12.2.15) accessible via HTTP.
Attacker crafts a malicious HTTP request targeting the Setup and Administration component. The specific endpoint and parameters will vary depending on the exact nature of the vulnerability, but no authentication is required.
The malicious HTTP request exploits a flaw in the input validation or processing logic of the Setup and Administration component.
This exploitation allows the attacker to inject arbitrary code into the Oracle AIT application.
The injected code is executed by the Oracle AIT server, granting the attacker initial access.
The attacker leverages this initial access to escalate privileges within the Oracle AIT system.
The attacker uses the elevated privileges to install a persistent backdoor, ensuring continued access even after the initial vulnerability is patched.
The attacker gains full control over the Oracle Advanced Inbound Telephony application, achieving a complete system takeover. This allows the attacker to access sensitive call data, manipulate telephony configurations, and potentially pivot to other systems on the network.

Impact

Successful exploitation of CVE-2026-34275 can result in a complete takeover of the Oracle Advanced Inbound Telephony system. This could lead to unauthorized access to sensitive call records, modification of telephony configurations, and disruption of critical communication services. The vulnerability allows unauthenticated attackers to compromise the system, potentially impacting all organizations using the affected versions (12.2.3-12.2.15) of Oracle E-Business Suite. The potential for complete system takeover makes this a high-impact vulnerability.

Recommendation

Apply the latest security patches provided by Oracle to address CVE-2026-34275 on all Oracle Advanced Inbound Telephony instances running versions 12.2.3-12.2.15.
Implement the provided Sigma rule Detect Oracle AIT CVE-2026-34275 Exploitation Attempt to detect potential exploitation attempts in your web server logs.
Monitor HTTP traffic to Oracle Advanced Inbound Telephony instances for suspicious activity, particularly requests targeting the Setup and Administration component.
Review and restrict network access to Oracle Advanced Inbound Telephony instances to only authorized users and systems.