Oracle, Splunk & Business-App Attacks

Business applications, phone platforms, engineering systems, and monitoring tools need the same attention to security advisories as network appliances. Start with the products you run, their configuration, and the people responsible for remediation.

This July 2026 briefing was technically reviewed on October 3, 2026. The references below include vendor updates published after the original article date. Use each vendor's current advisory and supported upgrade instructions when acting on an affected system.

Oracle business systems

Oracle's May 2026 security patch advisory lists CVE-2026-46817 in the Oracle Payments File Transmission component for E-Business Suite versions 12.2.3 through 12.2.15. The advisory identifies it as remotely exploitable without authentication and provides patch-availability references.

Oracle's CVE-2026-35273 alert covers PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62. It describes a remotely exploitable vulnerability requiring no authentication that may result in remote code execution.

Have the application owner check the affected release and required patches, including related dependencies. Limit access to administration and other sensitive functions according to the application's deployment needs. A product name or public web presence alone is not enough to determine which instance is vulnerable.

Splunk Enterprise

Splunk advisory SVD-2026-0603 describes unauthenticated arbitrary file creation or truncation through a network-reachable PostgreSQL sidecar endpoint. It affects Enterprise 10.0.0–10.0.6 and 10.2.0–10.2.3. Splunk reported limited exploitation in June 2026.

The historical fixed releases are 10.0.7 and 10.2.4; 10.4.0 is also listed as a fixed upgrade option. Enterprise 9.4 and earlier and Splunk Cloud are not affected by this vulnerability. Check the current supported upgrade for your deployment rather than assuming an old fixed release is today's preferred destination.

Splunk documents disabling the sidecar as a mitigation, with an explicit warning not to use that workaround on instances running Edge Processor, OpAmp, or SPL2 data pipelines because it breaks those features and may affect dependent processes. Have the responsible administrator follow the advisory and assess the dependencies.

Cisco phone platforms and PTC engineering systems

Cisco's CVE-2026-20230 advisory covers Unified Communications Manager and Session Management Edition with WebDialer enabled. The service is disabled by default. A crafted request can allow file writes that could later be used for privilege escalation. Cisco lists software updates and reports exploitation; check the exact affected configuration and upgrade path.

PTC's CVE-2026-12569 bulletin describes a remote code execution vulnerability in Windchill and FlexPLM. Its evolving bulletin links affected versions, remediation, patches, and indicators of compromise. Hosted instances have a different remediation workflow, so establish whether PTC or your own team is responsible.

Turn advisories into assigned work

1. Record the product, edition, running version, relevant configuration, and technical owner.
2. Have that owner check the primary advisory and confirm whether the instance is affected.
3. Prioritize remediation using exploitation information, exposure, business impact, and dependencies.
4. Confirm that the patch or mitigation was applied and that required functions still work.
5. Follow the vendor's investigation guidance where compromise is suspected. Patching does not erase an earlier intrusion.

Harborcoat can help organize a known application inventory, record vendor contacts and responsibilities, and coordinate the next steps with the teams doing the work. Bring those records to a planning conversation if ownership or vendor follow-through is getting in the way.