Threat reportVulnerabilityTL-2026-1616

Oracle Supply Chain: Multiple Vulnerabilities (CERT-Bund WID-SEC-2026-2450, Oracle CPU July 2026)

highACTIVE

Oracle Supply Chain (TL-2026-1616), also tracked as WID-SEC-2026-2450, is a high-severity software vulnerability, first published 2026-07-22. It has no confirmed attribution, affects Oracle Oracle Supply Chain (Oracle Supply Chain Products Suite), references 1 CVE (CVE-2026-21940), maps to 18 MITRE ATT&CK techniques (T1005, T1041, T1046), and is covered by 9 detection rules and 20 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
1Referenced vulnerabilities
Techniques
18MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
20Indicators of compromise

Key facts for TL-2026-1616

Threat ID
TL-2026-1616
Also known as
WID-SEC-2026-2450, Oracle CPU July 2026 - Supply Chain
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
manufacturing, retail, logistics, government administration, finance
Target regions
Global
Detection rules
9
Indicators of compromise
20

How Oracle Supply Chain works

CERT-Bund's WID-SEC-2026-2450 advisory (rated "hoch"/high) warns that a remote, anonymous or authenticated attacker can exploit multiple vulnerabilities in Oracle Supply Chain to compromise confidentiality, integrity, and availability. The advisory corresponds to Oracle's July 2026 Critical Patch Update, in which the Oracle Supply Chain product family received 39 security patches addressing 16 CVEs, with 16 of those exploitable over a network without authentication.

On 2026-07-21, Oracle released its July 2026 Critical Patch Update (CPU), the company's largest to date, covering 1,235 unique CVEs across 32 product families with 1,449 individual security patches (261 rated critical, 18% of all patches; 52.7% high severity, 24.7% medium; CVSS scores ranged up to 10.0). Within this release, the Oracle Supply Chain product family (which Oracle groups under its Supply Chain Management applications, including components historically covered by prior CPUs such as Agile PLM, Transportation Management, Global Trade Management, Supply Chain Collaboration, and Value Chain Planning) received 39 patches addressing 16 distinct CVEs. Oracle's own risk-matrix breakdown flags all 16 of these Supply Chain CVEs as remotely exploitable over a network by an attacker without requiring authentication credentials, which is the basis for CERT-Bund's "hoch" (high) severity rating in WID-SEC-2026-2450 and for the confidentiality/integrity/availability impact language in that advisory.

Oracle's authoritative per-CVE risk matrix (cpujul2026verbose.html) and the primary advisory page (cpujul2026.html) both returned HTTP 403 to automated fetch during this analysis, and CERT-Bund's WID portal is a JavaScript-rendered SPA that did not return the advisory body to WebFetch/WebSearch either. No secondary aggregator (Tenable, Security Boulevard, IMTR, OffSeq Threat Radar) that indexed the July 2026 CPU broke out individual CVE identifiers, CVSS vectors, or per-component detail specific to the Supply Chain family for THIS quarter's release at the time of research — they report only the family-level patch/CVE/remote-exploitability counts cited above. Per the no-invention rule, individual CVE IDs, CVSS scores/vectors, and specific vulnerable Supply Chain sub-components for the July 2026 disclosure itself are left null/empty rather than guessed; this threat should be revisited once Oracle's risk matrix becomes fetchable or a vendor/researcher writeup names the specific CVEs.

However, the Oracle Supply Chain family (specifically Oracle Agile PLM, a component of this family) has an established, sourced pattern of unauthenticated-remote-exploit vulnerabilities in prior 2026 CPU cycles that illustrates the likely exploit class for this disclosure: the January 2026 CPU patched CVE-2026-21969, a CVSS 3.1 9.8 unauthenticated remote-code-execution flaw in Oracle Agile PLM for Process 6.2.4's Supplier Portal component (analysts assessed likely root causes as insecure Java deserialization, unauthenticated malicious file upload, or authentication/session-bypass via header manipulation), CVE-2026-21940, a CVSS 7.5 unauthenticated information-disclosure flaw (CWE-200) in Agile PLM 9.3.6's User and User Group component, and CVE-2026-46859, a CVSS 9.8 unauthenticated RCE in Agile PLM 9.3.6's Security component. Separately, in the sibling Oracle E-Business Suite family (patched in the May 2026 CPU), CVE-2026-46817 — a CVSS 9.8 unauthenticated file-read/takeover flaw in the Oracle Payments "File Transmission" component (versions 12.2.3-12.2.15), exploited via crafted unauthenticated HTTP POST requests with XML payloads to the /OA_HTML/ibytransmit endpoint to redirect an internal Java function into arbitrary filesystem reads — was first observed under active exploitation in the wild by threat-intel firm Defused Cyber on 2026-06-27/29 and was added to CISA's KEV catalog on 2026-07-15, with federal agencies ordered to patch by 2026-07-18. This recurring pattern (unauthenticated, network-exploitable, CVSS ~9.8, HTTP-tier Oracle enterprise-application flaws that are weaponized in the wild within weeks to months of CPU patch release) is the primary basis for treating WID-SEC-2026-2450's 16 unauthenticated remote Supply Chain vulnerabilities as an urgent, high-confidence exploitation risk even absent per-CVE detail for this specific disclosure.

As a class, unauthenticated remotely-exploitable vulnerabilities in Oracle enterprise applications (per Oracle's own historical CPU risk-matrix patterns for products in this family) typically manifest as web-tier issues in the application's HTTP-exposed components — the standard exploitation path is direct network access to the exposed service without any prior authentication, i.e. MITRE ATT&CK's Exploit Public-Facing Application, frequently followed by insecure deserialization, unauthenticated file-upload/file-read primitives, command execution, and data exfiltration over the same HTTP channel. Defenders should treat this as an urgent patch-management item: apply the July 2026 CPU to all Oracle Supply Chain deployments, and monitor Oracle's own KEV history (Oracle products including E-Business Suite and, by component-family precedent, Agile PLM have both had CPU-era vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog in 2026) as a signal that unpatched Oracle enterprise-application flaws are actively targeted post-disclosure.

MITRE ATT&CK techniques used in TL-2026-1616

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Exfiltration

T1041 Exfiltration Over C2 Channel

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access

Impact

T1489 Service Stop; T1565 Data Manipulation

Persistence

T1505 Server Software Component

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

Affected products and versions in Oracle Supply Chain

  • Oracle — Oracle Supply Chain (Oracle Supply Chain Products Suite)
    Vulnerable versions: versions covered by the July 2026 Critical Patch Update risk matrix (specific versions not resolvable from available sources)
    Fixed in: Apply July 2026 Critical Patch Update
  • Oracle — Oracle Agile Product Lifecycle Management (PLM) for Process — Supplier Portal (historical precedent, same product family, January 2026 CPU)
    Vulnerable versions: 6.2.4
    Fixed in: Oracle January 2026 Critical Patch Update
  • Oracle — Oracle Agile PLM — User and User Group / Security components (historical precedent, same product family, January 2026 CPU)
    Vulnerable versions: 9.3.6
    Fixed in: Oracle January 2026 Critical Patch Update
  • Oracle — Oracle E-Business Suite — Oracle Payments, File Transmission component (sibling family precedent, May 2026 CPU, KEV-listed)
    Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
    Fixed in: Oracle May 2026 Critical Patch Update

Remediation for Oracle Supply Chain

Patches

  • Oracle July 2026 Critical Patch Update (cpujul2026.html) — Supply Chain product family, 39 patches / 16 CVEs
  • Oracle January 2026 CPU — patched CVE-2026-21969 and CVE-2026-21940 in Agile PLM (Supply Chain family precedent)
  • Oracle May 2026 CPU — patched CVE-2026-46817 in Oracle Payments/E-Business Suite (sibling family precedent, later added to KEV)

Immediate actions

  • Apply Oracle's July 2026 Critical Patch Update to all Oracle Supply Chain product deployments
  • Restrict network exposure of Oracle Supply Chain application HTTP/HTTPS endpoints to trusted networks pending patch
  • Review CERT-Bund WID-SEC-2026-2450 and Oracle's cpujul2026verbose.html risk matrix once accessible to identify the exact affected sub-components in your environment
  • Given the CVE-2026-21969/CVE-2026-46859/CVE-2026-46817 precedent, prioritize disabling or WAF-fronting any unauthenticated HTTP endpoints (e.g. Supplier Portal, file-transmission/upload handlers) in Oracle Supply Chain components pending patch

Workarounds

  • No vendor-documented workaround identified; apply the CPU as the primary remediation
  • As a stopgap per the E-Business Suite Payments precedent, disable or restrict network access to file-transmission/upload HTTP endpoints where the underlying Supply Chain component cannot be immediately patched

Longer-term hardening

  • Establish a quarterly Oracle CPU tracking and rapid-patch process for all Oracle Supply Chain/E-Business Suite/Fusion Middleware/Agile PLM deployments
  • Deploy WAF/network monitoring in front of Oracle Supply Chain web-tier components to detect anomalous unauthenticated requests, including crafted XML/POST payloads to transmission or upload endpoints
  • Subscribe to CISA KEV catalog updates for Oracle products given the pattern of Oracle CPU-era flaws later being added to KEV within weeks of patch release
  • Audit Oracle Agile PLM Supplier Portal, User/User Group, and Security component configurations for the deserialization, file-upload, and session-bypass weaknesses documented in prior 2026 CPU cycles

CVEs associated with Oracle Supply Chain

CVE-2026-21940

Timeline of Oracle Supply Chain

  • Oracle's January 2026 CPU patches CVE-2026-21969 (CVSS 9.8, unauthenticated RCE in Agile PLM for Process 6.2.4 Supplier Portal) and CVE-2026-21940 (CVSS 7.5, unauthenticated info disclosure in Agile PLM 9.3.6 User/User Group component) — both in the same Oracle Supply Chain product family, establishing the unauthenticated-remote-exploit pattern later echoed in WID-SEC-2026-2450.
  • Oracle's May 2026 CPU patches CVE-2026-46817 (CVSS 9.8, unauthenticated file-read/takeover in Oracle E-Business Suite Payments "File Transmission" component, versions 12.2.3-12.2.15), a sibling Oracle enterprise-application family to Supply Chain.
  • Threat-intel firm Defused Cyber observes the first unauthenticated exploitation attempts against CVE-2026-46817 in the wild via honeypot monitoring, roughly seven weeks after the patch shipped.
  • CISA adds CVE-2026-46817 (Oracle E-Business Suite Payments) to its Known Exploited Vulnerabilities catalog and orders U.S. federal civilian agencies to patch by 2026-07-18, confirming the pattern of Oracle CPU-era enterprise-application flaws being weaponized post-disclosure.
  • Tenable, Security Boulevard, IMTR, and OffSeq Threat Radar publish independent summaries of the July 2026 CPU, each confirming the Oracle Supply Chain family patch/CVE counts.
  • Oracle publishes cpujul2026.html and the accompanying verbose risk-matrix (cpujul2026verbose.html) detailing per-product CVE risk data.
  • Oracle releases the July 2026 Critical Patch Update, its largest to date, covering 1,235 unique CVEs / 1,449 patches across 32 product families, including 39 patches for 16 CVEs in the Oracle Supply Chain family.
  • Automated research finds Oracle's authoritative per-CVE risk matrix and the CERT-Bund advisory body both inaccessible to WebFetch/WebSearch (403 / JS-rendered SPA); analysis proceeds using only sourced family-level CPU statistics plus historical same-family/sibling-family CVE precedent.
  • TL-Intel-Harness ingests the CERT-Bund WID feed item and opens threat TL-2026-1616 for research.
  • CERT-Bund publishes WID-SEC-2026-2450, rating the Oracle Supply Chain multi-vulnerability disclosure "hoch" (high) and flagging remote, anonymous-or-authenticated exploitability with confidentiality/integrity/availability impact.

Sources cited for Oracle Supply Chain

Detection coverage for TL-2026-1616

As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1616 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
20 indicators of compromise · Red and above. Compare plans

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats