# Oracle Supply Chain: Multiple Vulnerabilities (CERT-Bund WID-SEC-2026-2450, Oracle CPU July 2026)

> CERT-Bund's WID-SEC-2026-2450 advisory (rated "hoch"/high) warns that a remote, anonymous or authenticated attacker can exploit multiple vulnerabilities in Oracle Supply Chain to compromise confidentiality, integrity, and availability. The advisory corresponds to Oracle's July 2026 Critical Patch Update, in which the Oracle Supply Chain product family received 39 security patches addressing 16 CVEs, with 16 of those exploitable over a network without authentication.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1616
- **ID:** TL-2026-1616
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-21940

## Description

On 2026-07-21, Oracle released its July 2026 Critical Patch Update (CPU), the company's largest to date, covering 1,235 unique CVEs across 32 product families with 1,449 individual security patches (261 rated critical, 18% of all patches; 52.7% high severity, 24.7% medium; CVSS scores ranged up to 10.0). Within this release, the Oracle Supply Chain product family (which Oracle groups under its Supply Chain Management applications, including components historically covered by prior CPUs such as Agile PLM, Transportation Management, Global Trade Management, Supply Chain Collaboration, and Value Chain Planning) received 39 patches addressing 16 distinct CVEs. Oracle's own risk-matrix breakdown flags all 16 of these Supply Chain CVEs as remotely exploitable over a network by an attacker without requiring authentication credentials, which is the basis for CERT-Bund's "hoch" (high) severity rating in WID-SEC-2026-2450 and for the confidentiality/integrity/availability impact language in that advisory.

Oracle's authoritative per-CVE risk matrix (cpujul2026verbose.html) and the primary advisory page (cpujul2026.html) both returned HTTP 403 to automated fetch during this analysis, and CERT-Bund's WID portal is a JavaScript-rendered SPA that did not return the advisory body to WebFetch/WebSearch either. No secondary aggregator (Tenable, Security Boulevard, IMTR, OffSeq Threat Radar) that indexed the July 2026 CPU broke out individual CVE identifiers, CVSS vectors, or per-component detail specific to the Supply Chain family for THIS quarter's release at the time of research — they report only the family-level patch/CVE/remote-exploitability counts cited above. Per the no-invention rule, individual CVE IDs, CVSS scores/vectors, and specific vulnerable Supply Chain sub-components for the July 2026 disclosure itself are left null/empty rather than guessed; this threat should be revisited once Oracle's risk matrix becomes fetchable or a vendor/researcher writeup names the specific CVEs.

However, the Oracle Supply Chain family (specifically Oracle Agile PLM, a component of this family) has an established, sourced pattern of unauthenticated-remote-exploit vulnerabilities in prior 2026 CPU cycles that illustrates the likely exploit class for this disclosure: the January 2026 CPU patched CVE-2026-21969, a CVSS 3.1 9.8 unauthenticated remote-code-execution flaw in Oracle Agile PLM for Process 6.2.4's Supplier Portal component (analysts assessed likely root causes as insecure Java deserialization, unauthenticated malicious file upload, or authentication/session-bypass via header manipulation), CVE-2026-21940, a CVSS 7.5 unauthenticated information-disclosure flaw (CWE-200) in Agile PLM 9.3.6's User and User Group component, and CVE-2026-46859, a CVSS 9.8 unauthenticated RCE in Agile PLM 9.3.6's Security component. Separately, in the sibling Oracle E-Business Suite family (patched in the May 2026 CPU), CVE-2026-46817 — a CVSS 9.8 unauthenticated file-read/takeover flaw in the Oracle Payments "File Transmission" component (versions 12.2.3-12.2.15), exploited via crafted unauthenticated HTTP POST requests with XML payloads to the /OA_HTML/ibytransmit endpoint to redirect an internal Java function into arbitrary filesystem reads — was first observed under active exploitation in the wild by threat-intel firm Defused Cyber on 2026-06-27/29 and was added to CISA's KEV catalog on 2026-07-15, with federal agencies ordered to patch by 2026-07-18. This recurring pattern (unauthenticated, network-exploitable, CVSS ~9.8, HTTP-tier Oracle enterprise-application flaws that are weaponized in the wild within weeks to months of CPU patch release) is the primary basis for treating WID-SEC-2026-2450's 16 unauthenticated remote Supply Chain vulnerabilities as an urgent, high-confidence exploitation risk even absent per-CVE detail for this specific disclosure.

As a class, unauthenticated remotely-exploitable vulnerabilities in Oracle enterprise applications (per Oracle's own historical CPU risk-matrix patterns for products in this family) typically manifest as web-tier issues in the application's HTTP-exposed components — the standard exploitation path is direct network access to the exposed service without any prior authentication, i.e. MITRE ATT&CK's Exploit Public-Facing Application, frequently followed by insecure deserialization, unauthenticated file-upload/file-read primitives, command execution, and data exfiltration over the same HTTP channel. Defenders should treat this as an urgent patch-management item: apply the July 2026 CPU to all Oracle Supply Chain deployments, and monitor Oracle's own KEV history (Oracle products including E-Business Suite and, by component-family precedent, Agile PLM have both had CPU-era vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog in 2026) as a signal that unpatched Oracle enterprise-application flaws are actively targeted post-disclosure.

## MITRE ATT&CK

- T1590 Gather Victim Network Information
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1212 Exploitation for Credential Access
- T1518 Software Discovery
- T1046 Network Service Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation
- T1489 Service Stop

## Sources

- [NEU hoch Oracle Supply Chain: Mehrere Schwachstellen (WID-SEC-2026-2450)](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2450)
- [Oracle Critical Patch Update Advisory - July 2026](https://www.oracle.com/security-alerts/cpujul2026.html)
- [Text Form of Oracle CPU July 2026 Risk Matrices](https://www.oracle.com/security-alerts/cpujul2026verbose.html)
- [Oracle July 2026 Critical Patch Update Addresses 1235 CVEs](https://www.tenable.com/blog/oracle-july-2026-critical-patch-update-addresses-1235-cves)
- [Oracle July 2026 Critical Patch Update Addresses 1235 CVEs](https://securityboulevard.com/2026/07/oracle-july-2026-critical-patch-update-addresses-1235-cves/)
- [Oracle July 2026 Critical Patch Update Addresses 1235 CVEs — IronMonkey Threat Intelligence](https://www.imtr.net/article/oracle-july-2026-critical-patch-update-addresses-1235-cves-844b)
- [Oracle July 2026 Critical Patch Update Addresses 1235 CVEs - Threat Radar](https://radar.offseq.com/threat/oracle-july-2026-critical-patch-update-addresses-1235-cves-d66048a2fadaf3f4)
- [July 2026 Critical Patch Update Released](https://blogs.oracle.com/security/july-2026-critical-patch-update-released)
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oracle E-Business Suite context)](https://www.cisa.gov/news-events/alerts/2026/07/15/cisa-adds-two-known-exploited-vulnerabilities-catalog)
- [Technical Analysis of CVE-2026-21969: Oracle Agile PLM for Process Supplier Portal RCE](https://www.cyberhub.blog/cves/CVE-2026-21969)
- [Oracle Agile PLM: Unauthenticated RCE in Supplier Portal (CVE-2026-21969)](https://www.thehackerwire.com/oracle-agile-plm-unauthenticated-rce-in-supplier-portal-cve-2026-21969/)
- [CVE-2026-21940: Oracle Agile PLM Information Disclosure](https://www.sentinelone.com/vulnerability-database/cve-2026-21940/)
- [Attackers actively exploit the Oracle E-Business Suite flaw CVE-2026-46817](https://securityaffairs.com/194463/security/attackers-actively-exploit-the-oracle-e-business-suite-flaw-cve-2026-46817.html)
- [Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild](https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html)
- [CISA orders feds to patch actively exploited Oracle flaw by Saturday](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-actively-exploited-oracle-flaw-by-saturday/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1616