Today’s Field Note

CISA added an actively exploited Oracle E-Business Suite vulnerability to the KEV catalog with a rare short fuse: federal agencies have until Saturday to patch. This is the Financials module, which means the exposed systems are the ones holding your invoicing, payments, and vendor data, exactly what post-exploit operators want. Separately, Zoom disclosed CVE-2026-53412 (CVSS 9.8), an improper input validation flaw in the Windows Desktop Client, VDI Client, and Meeting SDK that an unauthenticated attacker can leverage for account takeover. Neither of these waits for your change window. If you run EBS on the internet, assume it was scanned before the advisory landed.

Today’s Action

  • Inventory every Oracle E-Business Suite instance (especially Financials) and apply Oracle’s fix now, not by Saturday. Do not assume internal-only means safe.
  • Hunt EBS hosts for post-exploit signs: unexpected web shells, new admin accounts, and outbound connections from the app tier.
  • Push the Zoom update for Windows Desktop Client, VDI Client, and Meeting SDK to all endpoints; force-close and relaunch to confirm the version bumped.
  • Pull external-facing EBS behind VPN or IP allowlisting if patching lags, and rotate any service credentials that touched those systems.
  • Flag both CVEs to your incident channel so on-call knows what to correlate against tonight.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

File it under “already happening,” because it was.

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.