Oracle E-Business Suite Improper Privilege Management Exploitation (CVE-2026-46817)

let EBSPaths = dynamic(["/OA_HTML/", "/OA_CGI/", "/servlet/AppsLogin", "/OA_HTML/AppsLocalLogin.jsp", "/OA_HTML/RF.jsp"]);
W3CIISLog
| where csUriStem has_any (EBSPaths)
| where scStatus in (200, 302) and (csMethod == "POST" or csUriQuery has_any ("SSO", "guest", "bypass"))
| summarize RequestCount = count(), DistinctPaths = dcount(csUriStem), Methods = make_set(csMethod) by cIP, csHost, bin(TimeGenerated, 5m)
| where RequestCount > 20 or DistinctPaths > 5
| project TimeGenerated, cIP, csHost, RequestCount, DistinctPaths, Methods

index=web_logs sourcetype=iis OR sourcetype=access_combined
(uri_path="*/OA_HTML/*" OR uri_path="*/OA_CGI/*" OR uri_path="*/servlet/AppsLogin*")
| bin _time span=5m
| stats count as request_count, dc(uri_path) as distinct_paths, values(http_method) as methods by src_ip, host, _time
| where request_count > 20 OR distinct_paths > 5
| sort -request_count

sequence by source.ip with maxspan=10m
  [network where url.path : ("*/OA_HTML/*", "*/OA_CGI/*", "*/servlet/AppsLogin*") and http.response.status_code in (200, 302)]
  [network where url.path : "*/OA_HTML/RF.jsp*" and http.request.method == "POST"]

SELECT sourceip, destinationip, url, COUNT(*) as request_count
FROM events
WHERE url ILIKE '%/OA_HTML/%' OR url ILIKE '%/OA_CGI/%' OR url ILIKE '%/servlet/AppsLogin%'
GROUP BY sourceip, destinationip, url
ORDER BY request_count DESC
LAST 1 HOURS

_sourceCategory=web/access
| where uri_path matches "*/OA_HTML/*" or uri_path matches "*/OA_CGI/*" or uri_path matches "*/servlet/AppsLogin*"
| timeslice 5m
| count as request_count, count_distinct(uri_path) as distinct_paths by src_ip, _timeslice
| where request_count > 20 or distinct_paths > 5

rule ebs_privilege_escalation_cve_2026_46817 {
  meta:
    description = "Detects requests to Oracle EBS endpoints associated with CVE-2026-46817 exploitation"
    severity = "Critical"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /(OA_HTML|OA_CGI|servlet\/AppsLogin)/ nocase
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
  match:
    $e over 5m
  condition:
    $e
}

#event_simple_name=NetworkConnectIP4 OR #event_simple_name=DnsRequest
| RemoteAddressIP4=* AND (Uri="*OA_HTML*" OR Uri="*OA_CGI*" OR Uri="*servlet/AppsLogin*")
| groupBy([RemoteAddressIP4, ComputerName], function=[count(as=request_count)])
| filter(request_count > 20)