#!/usr/bin/env python3
"""Scope Oracle E-Business Suite CVE-2026-46817 exposure from local inventories and exported logs."""
from __future__ import annotations
import json, os, sys
from pathlib import Path
CVE_IDS=['CVE-2026-46817']
VENDOR='Oracle'
PRODUCT='Oracle E-Business Suite / Oracle Payments File Transmission'
AFFECTED_VERSION_SELECTORS=['oracle-e-business-suite-oracle-payments >= 12.2.3 <= 12.2.15']
FIXED_OR_MITIGATION_SELECTORS=['fixed: Oracle May 2026 Critical Patch Update for Oracle Payments File Transmission / E-Business Suite']
SOURCE_SELECTORS=['https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json', 'https://www.oracle.com/security-alerts/cspumay2026.html', 'https://nvd.nist.gov/vuln/detail/CVE-2026-46817', 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817']
DOMAINS=[]; HASHES=[]; URLS=[]; FILES=[]; NETWORK_PATTERNS=[]
PROCESS_PATTERNS=['Oracle E-Business Suite / Oracle Payments File Transmission', 'Oracle', 'CVE-2026-46817']
PRODUCT_TELEMETRY_PATTERNS=['Oracle Payments', 'Oracle E-Business Suite', 'File Transmission', '12.2.3', '12.2.15', 'May 2026 Critical Patch Update', 'CVE-2026-46817', 'HTTP', 'Oracle Payments takeover']
INDICATORS=list(dict.fromkeys(CVE_IDS+[VENDOR,PRODUCT]+AFFECTED_VERSION_SELECTORS+FIXED_OR_MITIGATION_SELECTORS+SOURCE_SELECTORS+PRODUCT_TELEMETRY_PATTERNS))
OUT=os.environ.get('OUT','hp-oracle-ebusiness-suite-cve-2026-46817-kev-scope')
TEXT_SUFFIXES={'.csv','.json','.jsonl','.txt','.log','.yaml','.yml','.xml','.conf','.ini','.md'}
EXCLUDED_DIR_NAMES={'.git','node_modules','vendor','dist','__pycache__','.venv'}
def read_text(path: Path)->str:
try: return path.read_text(encoding='utf-8', errors='ignore')
except Exception: return ''
def iter_files(root: Path):
if root.is_file(): yield root; return
for p in root.rglob('*'):
if p.is_file() and not any(part in EXCLUDED_DIR_NAMES for part in p.parts):
if not p.suffix or p.suffix.lower() in TEXT_SUFFIXES: yield p
def scan(root: Path):
matches=[]; lowered=[s.lower() for s in INDICATORS if s]
for path in iter_files(root):
low=read_text(path).lower(); hits=sorted({INDICATORS[i] for i,s in enumerate(lowered) if s in low})
if hits: matches.append({'path':str(path),'hits':hits})
return matches
def main(argv=None):
argv=argv or sys.argv[1:]; root=Path(argv[0]) if argv else Path('.')
matches=scan(root); out_dir=Path(OUT); out_dir.mkdir(parents=True, exist_ok=True)
report={'cves':CVE_IDS,'vendor':VENDOR,'product':PRODUCT,'affected_version_selectors':AFFECTED_VERSION_SELECTORS,'fixed_or_mitigation_selectors':FIXED_OR_MITIGATION_SELECTORS,'match_count':len(matches),'matches':matches}
(out_dir/'scope_report.json').write_text(json.dumps(report,indent=2),encoding='utf-8')
print(json.dumps({'cves':CVE_IDS,'match_count':len(matches),'report':str(out_dir/'scope_report.json')},indent=2))
return 2 if matches else 0
if __name__=='__main__': raise SystemExit(main())