CISA Orders US Federal Agencies to Fix Oracle Flaw by Saturday

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to fix a critical vulnerability in the Oracle E-Business Suite financial application by Saturday.

According to CISA, the vulnerability is being actively exploited by attackers in real-world attacks. That is precisely why the agency set a tight deadline for government institutions to address the issue.

What we know

Oracle E-Business Suite is a set of business applications that organizations use to manage financial and other corporate processes. A vulnerability in software like this makes it an attractive target for attacks, since such systems can give attackers access to sensitive financial data.

CISA's directive applies to US federal agencies and requires them to put protective measures in place by the specified deadline. Directives of this kind are issued under the Known Exploited Vulnerabilities program and are mandatory for civilian federal agencies.

Context

The fact that the vulnerability is already being used in real-world attacks underscores the urgency of responding. Organizations that use Oracle E-Business Suite — typically large companies and government bodies — remain at risk until the relevant patch is applied.

While CISA's directive formally applies only to federal agencies, security experts have long recommended that any organization running the vulnerable software treat such directives as a benchmark and promptly apply the available security updates.

Source: Bleeping Computer