Critical Actively exploited

CVE-2026-46817

Oracle E-Business Suite Improper Privilege Management Vulnerability

What this means

Weakness: Privilege handling is faulty, so an account ends up with more rights than intended.
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 18 July 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 15 July 2026
CVSS: —
EPSS: 13.31% probability of exploitation within 30 days · above 96% of all CVEs
Weakness: CWE-269 CWE-287 CWE-306
CISA due date: 18 July 2026 past due
Sources: cisa-kev

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46817