Researchers Observe Exploitation of Critical Oracle E-Business Suite Flaw
Summary
Defused researchers observed six attempts to exploit Oracle E-Business Suite flaw CVE-2026-46817 in two hours. The activity came from one IP before a public proof of concept; Shadowserver found about 950 potentially vulnerable instances.
Key points
- Defused observed six attempts to exploit CVE-2026-46817 on honeypots during a two-hour period.
- The attempts came from a single IP address before any public proof of concept was available.
- A Defused executive characterized the limited activity as more consistent with reconnaissance and weaponization testing than targeting a specific victim.
- Oracle patched the critical flaw in late May and assigned it a severity rating of 9.8.
- Shadowserver scans found about 950 potentially vulnerable Oracle E-Business Suite instances; more than half of the publicly exposed deployments were in the United States.
- The article cites earlier Oracle-related attack activity involving Clop and ShinyHunters, but does not link those groups to this exploitation.
Article Details
- Vulnerability Types
- Critical flaw in Oracle E-Business Suite's payments processing feature
- Severity
- Critical; rated 9.8
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- available
CVE
People
Threat Actors
ClopThe article says the Clop ransomware group exploited a zero-day and other Oracle E-Business Suite vulnerabilities last year and attempted to extort dozens of victims.ShinyHuntersThe article identifies ShinyHunters as behind an attack spree involving PeopleSoft; it says the group potentially infiltrated more than 100 organizations, mostly in higher education, according to Mandiant and Google Threat Intelligence Group.
Malware
Vendors
Products
Oracle E-Business SuiteA cybercriminal began exploiting CVE-2026-46817, a critical flaw in Oracle E-Business Suite’s payments processing feature, with researchers observing six attacks in a two-hour window.PeopleSoftOracle customers were more recently impacted by an actively exploited zero-day vulnerability in PeopleSoft, which includes more than 40 tools for human resources and customer relationship management.