Oracle EBS attacked before exploit code went public

Key Takeaways

• Attackers exploited CVE-2026-46817 in Oracle EBS Payments module before any public proof-of-concept existed
• The vulnerability scores 9.8 CVSS and allows unauthenticated file access on affected servers
• Around 950 EBS instances remain exposed to the public internet, mostly in the US

Attackers exploited a critical Oracle E-Business Suite vulnerability just six weeks after Oracle patched it, and they did so without any public exploit code to work from. Security researchers at Defused observed the first attacks on June 27, targeting Oracle's Payments File Transmission component. The attackers appear to have reverse-engineered Oracle's May patch to build their own working exploit.

How did attackers exploit the Oracle EBS flaw so quickly?

The vulnerability, tracked as CVE-2026-46817, carries a CVSS score of 9.8. That's near the maximum severity rating. It affects Oracle EBS releases 12.2.3 through 12.2.15 and allows unauthenticated attackers to read arbitrary files from vulnerable servers. No login required.

Defused's honeypots recorded six exploitation attempts from a single source. The researchers noted this wasn't the usual spray-and-pray scanning that follows major vulnerability disclosures. The requests targeted specific sensitive files, suggesting the attacker was validating a technique rather than casting a wide net.

The timing matters. Exploitation began before any public proof-of-concept code existed. That points to an attacker who either reverse-engineered Oracle's patch (a technique called "patch diffing") or obtained a private exploit through other means. Either scenario demonstrates significant capability.

How many Oracle EBS servers are exposed?

The Shadowserver Foundation currently tracks around 950 EBS instances exposed to the public internet, with the majority located in the US. The foundation stressed that exposure doesn't equal vulnerability. Some of those servers may be fully patched.

But 950 is still 950 potential targets. Oracle E-Business Suite handles financial operations, supply chain management, and HR data for thousands of large organizations. The Payments module specifically processes sensitive financial file transmissions. It's a high-value target.

This fits a troubling pattern

Earlier this month, researchers warned that attackers exploited a critical PeopleSoft zero-day before patches were widely deployed. The ShinyHunters crew claimed to have compromised more than 100 organizations, boasting about stolen HR and payroll data.

Last year brought Clop's lengthy campaign against Oracle E-Business Suite customers. The ransomware group targeted internet-facing EBS servers for months before the activity became public. Enterprise software has become a lucrative hunting ground for cybercriminals.

Critical updates now double as roadmaps. Anyone prepared to reverse-engineer the fixes can potentially beat customers to deployment. The window between patch release and exploitation keeps shrinking.

What should EBS customers do now?

Apply Oracle's May Critical Patch Update immediately if you haven't already. Six weeks is too long for a 9.8 CVSS vulnerability, especially when attackers are actively probing for targets.

• Verify your EBS version falls outside the 12.2.3-12.2.15 range, or confirm the patch is applied
• Check whether your EBS Payments module is exposed to the internet. If possible, move it behind a VPN or restrict access
• Review logs for unusual file access patterns, particularly targeting configuration or credential files
• Monitor Defused and Shadowserver for updated indicators of compromise

The broader lesson: patch cycles designed for quarterly schedules don't match the speed of modern exploitation. When a vendor releases a critical fix, assume someone is already working to reverse-engineer it.

Frequently Asked Questions

What is CVE-2026-46817?

It's a critical vulnerability in Oracle E-Business Suite's Payments File Transmission component. With a 9.8 CVSS score, it allows unauthenticated attackers to read arbitrary files from affected servers running versions 12.2.3 through 12.2.15.

Was there a public exploit available before the attacks?

No. Defused researchers confirmed exploitation began before any public proof-of-concept code existed, suggesting attackers reverse-engineered Oracle's May patch or obtained a private exploit.

How many Oracle EBS servers are at risk?

Shadowserver tracks around 950 EBS instances exposed to the public internet, primarily in the US. However, exposure doesn't confirm vulnerability. Some may already be patched.

When did Oracle release the patch?

Oracle fixed CVE-2026-46817 in its May 2026 Critical Patch Update. Exploitation was first observed on June 27, 2026, roughly six weeks later.

Is this related to the Clop ransomware attacks on Oracle?

Not directly, but it follows the same pattern. Clop previously targeted internet-facing EBS servers in a lengthy campaign disclosed last year. Enterprise ERP systems have become consistent targets for cybercriminals.

Source: www.theregister.com