24JUL

Oracle EBS gets a 3-day patch clock

1 min read

18:20UTC

CISA gave Oracle E-Business Suite a three-day federal patch deadline on 15 July for a privilege-management flaw on a platform with a Clop extortion history.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyAssessed

Key takeaway

Oracle E-Business Suite's three-day KEV deadline flags ransomware risk given its Clop exploitation history.

CISA flagged Oracle E-Business Suite flaw CVE-2026-46817, an improper privilege-management bug, as a Known Exploited Vulnerability (KEV) on 15 July and gave federal agencies three days to patch it. Oracle E-Business Suite is the company's enterprise resource-planning (ERP) software for finance, supply-chain and HR operations, deployed deep inside large organisations.

The platform carries a Clop mass-exploitation history, the extortion crew behind the 2023 MOVEit file-transfer campaign that breached hundreds of organisations. For a chief information security officer (CISO), a listing on a platform with that lineage reads as an early ransomware warning rather than a routine patch note.

The three-day window matches the compressed deadline CISA attached to the first-ever Splunk catalogue entry in June, a timeline it reserves for flaws it expects attackers to mass-exploit fast. Clop's method is to hit an enterprise flaw at scale before defenders finish patching, then extort the data it lifts, which is why a privilege bug on widely deployed ERP software carries weight beyond its CVE score.

Deep Analysis

In plain English

Oracle E-Business Suite is business software many large companies use to run their finance, supply chain and HR systems. On 15 July, CISA added a flaw in it, CVE-2026-46817, to its list of actively exploited vulnerabilities, giving US federal agencies just three days to fix it, one of the shortest deadlines CISA sets. The extortion crew Clop has targeted this kind of software before, most notably in its 2023 attack on MOVEit file-transfer software that hit thousands of organisations. The tight three-day deadline reflects how seriously CISA rates the risk of this specific flaw being exploited.

Deep Analysis

Root Causes

Oracle E-Business Suite's three-day federal deadline reflects the platform's top-tier placement under CISA's risk-tiered BOD 26-04, reserved for flaws assessed as both easily exploitable and high-impact given how deeply ERP software is wired into finance, supply chain and HR processes.

Privilege-management bugs in ERP platforms are structurally attractive to extortion crews like Clop because a single escalation from a low-privileged account can expose the exact financial and personal records that make double-extortion ransom demands credible.

Escalation

No threat actor has yet been publicly attributed to active exploitation of CVE-2026-46817 itself, so this is a precautionary top-tier deadline rather than confirmed follow-on activity by Clop.

What could happen next?

Risk
Oracle E-Business Suite's three-day deadline places it in CISA's top urgency tier, indicating the agency assesses both easy exploitability and high potential impact given the platform's finance and HR data holdings.
Precedent
Clop's documented history of exploiting enterprise back-office software, including the 2023 MOVEit campaign, makes Oracle EBS a plausible future target even without confirmed current exploitation.

Sources:CISA

Mentions:CISA →Clop →MOVEit →Known Exploited Vulnerabilities →Oracle →Splunk →CVE-2026-48172 →Oracle E-Business Suite →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CISA· 24 Jul 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.