Over 900 Oracle E-Business instances exposed to ongoing attacks

Home News Security Over 900 Oracle E-Business instances exposed to ongoing attacks

By Sergiu Gatlan

July 1, 2026

08:30 AM

Over 900 Oracle E-Business Suite (EBS) instances have been found exposed online amid ongoing attacks exploiting a critical security flaw.

The vulnerability (tracked as CVE-2026-46817) was found in the File Transmission component of EBS's Oracle Payments product and allows malicious actors without privileges and with HTTP network access to take over vulnerable systems through low-complexity attacks.

Oracle has patched this flaw with security updates released as part of its May 2026 Critical Security Patch Update and urged customers to patch their systems immediately.

While the company has yet to flag this flaw as exploited in attacks, threat intelligence company Defused warned on Monday that threat actors are now actively exploiting it, with the first attempts spotted over the weekend.

"CVE-2026-46817 (CVSS 9.8 unauth HTTP takeover in Oracle E-Business) is being exploited. Over the weekend, we observed an actor exploiting the vulnerability on our Oracle E-Business honeypots. This vulnerability has no known previous exploitation and no public POC code exists," Defused noted.

Earlier today, internet security watchdog Shadowserver also warned that it tracks around 950 Oracle EBS instances exposed online. However, there is no information regarding how many of these systems have been secured against CVE-2026-46817 attacks.

Oracle EBS instances exposed online (Shadowserver)

Last month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also tagged a high-severity Oracle WebLogic Server flaw (CVE-2024-21182) patched two years ago as actively exploited in the wild.

Weeks later, Oracle mitigated a critical PeopleSoft Suite zero-day (CVE-2026-35273) that was exploited by the ShinyHunters extortion gang to gain unauthenticated remote code execution between May 27 and June 9 and to steal data from many organizations worldwide, including Nottingham University and the National Association of Insurance Commissioners (NAIC).

Most recently, Nissan also warned of a data breach affecting current and former employees following the compromise of its Oracle PeopleSoft instance.

Since early August 2025, the Clop extortion gang has exploited another Oracle EBS security flaw (CVE-2025-61882) in zero-day attacks targeting U.S. universities (including Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix), as well as high-profile victims like Logitech, GlobalLogic, and the Washington Post.

CISA has added 44 vulnerabilities across various Oracle products to its catalog of actively exploited flaws since November 2021, 13 of which were also abused by ransomware gangs.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen. The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Hackers now exploit critical Oracle E-Business flaw in attacks Critical SimpleHelp flaw exploited to deploy new stealer malware CISA sets urgent deadline to fix Cisco flaw exploited in attacks CISA warns of max severity Ubiquiti flaws exploited in attacks Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks

Actively Exploited

Oracle

Oracle E-Business Suite

Shadowserver

Vulnerability

Warning

Sergiu Gatlan

Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Over 900 Oracle E-Business instances exposed to ongoing attacks

Related Articles

(no title)

Is AI ruining our skills? Early results are in – and they're not good

The Anatomy of an AI-Native Org

Apertus – Open Foundation Model for Sovereign AI

The labor share of income in the US is at its lowest post-war level