CVE-2026-46817 IBM QRadar · QRadar

Detect Oracle E-Business Suite Improper Privilege Management Exploitation (CVE-2026-46817) in IBM QRadar

Detects exploitation attempts and post-exploitation indicators associated with CVE-2026-46817, an improper privilege management vulnerability in Oracle E-Business Suite (CWE-269, CWE-287, CWE-306) that allows unauthenticated or low-privileged actors to escalate privileges or bypass authentication controls on EBS application and concurrent manager components. This vulnerability is listed in CISA KEV and is subject to BOD 26-04 remediation timelines. Detection focuses on anomalous authentication bypass patterns, privilege escalation to APPS/SYSADMIN roles, unexpected concurrent manager job submissions, and suspicious HTTP requests to EBS servlet endpoints associated with known exploitation chains.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Defense Evasion Credential Access

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, url, COUNT(*) as request_count
FROM events
WHERE url ILIKE '%/OA_HTML/%' OR url ILIKE '%/OA_CGI/%' OR url ILIKE '%/servlet/AppsLogin%'
GROUP BY sourceip, destinationip, url
ORDER BY request_count DESC
LAST 1 HOURS
high severity medium confidence

Aggregates HTTP requests targeting Oracle EBS login and concurrent manager endpoints to surface reconnaissance or exploitation attempts for CVE-2026-46817.

Data Sources

Web Proxy/Firewall Flow Data

Required Tables

events

False Positives & Tuning

  • Scheduled batch jobs or interfaces polling EBS URLs from known service accounts
  • Internal monitoring dashboards refreshing EBS status pages
  • Authorized red team activity not yet whitelisted in QRadar reference sets

Other platforms for CVE-2026-46817

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate anomalous EBS login endpoint request burst

    Expected signal: Web server access logs recording 30 sequential requests to /OA_HTML/AppsLocalLogin.jsp from a single source IP within a short window

  2. Test 2Simulate privilege escalation via concurrent manager job submission

    Expected signal: EBS FND_CONCURRENT_REQUESTS entry showing job submission under SYSADMIN responsibility from the test account, correlated with prior web request to RF.jsp

  3. Test 3Simulate reconnaissance scan of EBS OA_CGI paths

    Expected signal: Web access logs showing sequential requests to distinct OA_CGI paths from the same source IP within a short timeframe

Last updated: 2026-07-16 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify all internet-facing and internal Oracle E-Business Suite instances and confirm patch level against Oracle's May 2026 Critical Patch Update (cspumay2026) to determine exposure to CVE-2026-46817.
  2. Review web server and WAF logs for the affected EBS hosts over the prior 30 days for anomalous access to /OA_HTML/, /OA_CGI/, and AppsLogin servlet paths, especially from unauthenticated or unexpected source IPs.
  3. Cross-reference EBS application audit logs (FND_LOGINS, ICX sessions) for privilege escalations to APPS/SYSADMIN responsibilities that do not correlate with a legitimate change request or known administrator activity.
  4. Check concurrent manager job queues for unexpected or unauthorized job submissions, particularly jobs running with elevated APPS schema privileges shortly after suspicious web requests.

Containment

  1. If exploitation is confirmed or suspected, isolate the affected EBS environment from the internet (restrict at WAF/firewall) while preserving internal access for remediation teams, and apply Oracle's May 2026 CPU patch or documented workaround immediately.
  2. Rotate credentials for any accounts observed with anomalous privilege escalation, and force re-authentication/session invalidation for all active EBS sessions on affected instances.

Evidence Collection

  1. Preserve web server access/error logs, WAF logs, and EBS application audit tables (FND_LOGINS, FND_CONCURRENT_REQUESTS, ICX_SESSIONS) covering the suspected exploitation window before log rotation purges them.
  2. Capture a forensic snapshot of the EBS application tier (filesystem timestamps, deployed JSP/servlet files, database session tables) to identify webshells, unauthorized code changes, or persistence mechanisms.

Escalation Criteria

  • !Escalate to incident response leadership immediately if evidence shows successful privilege escalation to SYSADMIN/APPS roles or unauthorized data access/exfiltration from EBS, given this CVE's CISA KEV and BOD 26-04 designation.
  • !Escalate if the affected EBS instance processes regulated data (financial, HR, PII) or is internet-facing, since BOD 26-04 mandates expedited remediation and may require external reporting obligations.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >EBS application audit tables: FND_LOGINS, ICX_SESSIONS, FND_CONCURRENT_REQUESTS showing unexpected privilege changes or job submissions
  • >Web/application server access and error logs referencing OA_HTML, OA_CGI, and AppsLogin servlet paths
  • >Filesystem timestamps and integrity baselines for EBS application tier JSP/servlet directories indicating unauthorized modification

Tuning Guidance

Baseline known administrator, monitoring, and integration source IPs that legitimately access EBS login and servlet endpoints, and exclude them via allowlists to reduce noise. Tune request-count thresholds upward in environments with high-volume automated integrations, and correlate web-tier alerts with EBS application audit log privilege-escalation events before escalating, since web-tier signals alone are low-fidelity for this vulnerability class.

Hunting Queries

Hunts for access to Oracle EBS sensitive endpoints from source IPs not on the known administrator allowlist.

Hunting — KQL
kql 
W3CIISLog
| where csUriStem has_any ("/OA_HTML/", "/OA_CGI/", "/servlet/AppsLogin")
| where cIP !in (KnownAdminIPs)
| summarize count() by cIP, csUriStem, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=web_logs (uri_path="*/OA_HTML/*" OR uri_path="*/OA_CGI/*" OR uri_path="*/servlet/AppsLogin*") NOT [| inputlookup known_admin_ips.csv]
| stats count by src_ip, uri_path, _time

Atomic Red Team Tests

Test 1 Simulate anomalous EBS login endpoint request burst
linux

Generates a burst of HTTP requests to a lab EBS AppsLogin endpoint to validate detection of authentication bypass reconnaissance patterns.

Command

bash 
for i in $(seq 1 30); do curl -s -o /dev/null -w '%{http_code}\n' 'http://lab-ebs.internal/OA_HTML/AppsLocalLogin.jsp?guest=Y'; done

Cleanup

bash 
No persistent changes made; clear local curl history if required: history -c

Expected Telemetry

Web server access logs recording 30 sequential requests to /OA_HTML/AppsLocalLogin.jsp from a single source IP within a short window

Expected Detection

KQL/SPL request-burst rules trigger on RequestCount > 20 within the 5-minute bin for the test source IP

Test 2 Simulate privilege escalation via concurrent manager job submission
windows

In a lab EBS instance, submit a concurrent manager job under an elevated responsibility to emulate unauthorized privilege escalation behavior.

Command

powershell 
powershell -Command "Invoke-RestMethod -Uri 'http://lab-ebs.internal/OA_HTML/RF.jsp?function_id=SUBMIT_REQUEST&responsibility=SYSADMIN' -Method POST"

Cleanup

powershell 
Cancel/delete the test concurrent request from the EBS concurrent manager console (FNDCPGSC)

Expected Telemetry

EBS FND_CONCURRENT_REQUESTS entry showing job submission under SYSADMIN responsibility from the test account, correlated with prior web request to RF.jsp

Expected Detection

Elastic EQL sequence rule fires linking AppsLogin access to subsequent RF.jsp POST request within 10 minutes

Test 3 Simulate reconnaissance scan of EBS OA_CGI paths
linux

Runs a directory enumeration script against lab EBS OA_CGI paths to emulate attacker reconnaissance preceding exploitation of CVE-2026-46817.

Command

bash 
for path in FND_WEB_RTY OA_CGI/FNDWFCTX OA_CGI/FNDWRR; do curl -s -o /dev/null -w '%{http_code} %{url_effective}\n' "http://lab-ebs.internal/$path"; done

Cleanup

bash 
No persistent state changes; no cleanup required beyond clearing shell history

Expected Telemetry

Web access logs showing sequential requests to distinct OA_CGI paths from the same source IP within a short timeframe

Expected Detection

SPL/QRadar AQL distinct-path aggregation rules trigger when DistinctPaths exceeds threshold for the test source IP

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0005Defense EvasionTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1548Abuse Elevation Control Mechanism

Same Tactic: Initial Access

Popular Detections