2 CVEs. Not a patching problem.
Scattered Spider is leveraging CVE-2026-48558 and CVE-2026-46817 to target SimpleHelp and Oracle E-Business Suite, with a 14-day median dwell time. The technical mechanics involve exploiting these vulnerabilities to gain initial access, then using tools like TaskWeaver to establish persistence.
What everyone reads as a vulnerability problem is actually a patch governance failure. 42% of exploited vulnerabilities in 2025 were weaponized before public disclosure, according to the CrowdStrike Global Threat Report 2026. This pattern is rooted in geopolitical tensions, with state-nexus actors increasingly involved in cyber espionage.
The defensive math: -> Implement a vulnerability management process that prioritizes timely patching of critical CVEs, aiming for a 7-day patch window. -> Conduct regular security audits to identify and address potential exploitation windows, reducing the median dwell time to under 10 days. -> Develop an incident response plan that incorporates threat intelligence on active exploits, like those targeting Oracle E-Business Suite.
Can your team patch critical CVEs within 7 days of public disclosure?