Emerging ThreatsMalware & Ransomware

Oracle Exploit Spotted in Wild Ahead of Proof-of-Concepts

Analyst 207||Source: CyberScoop
Rows of equipment racks and servers in a brightly-lit, neutral-colored server room.
“With only one IP and one day of data, it reads more like reconnaissance and weaponization testing than a targeted campaign against a specific victim,” Simo Kohonen, founder and CEO of threat intelligence firm Defused, told CyberScoop after his company logged a fresh round of exploitation attempts against Oracle.

The attempts targeted a critical defect in the payments processing feature of Oracle E-Business Suite that Oracle disclosed and patched in late May. The vulnerability is tracked as CVE-2026-46817 and carries a 9.8 severity rating; Oracle warned the flaw’s exploitation complexity is low. Defused observed six exploit attempts in a two-hour window over the course of a Saturday and attributed them to a single IP address, noting the activity preceded any public proof-of-concept releases.

CVE-2026-46817 and Oracle's patch

Oracle disclosed and patched the defect in late May, assigning it the identifier CVE-2026-46817 and assigning a 9.8 severity score. Oracle’s advisory included a note that exploitation complexity is low, a detail repeated in reporting of the attacks. The affected component is the payments processing feature of Oracle E-Business Suite, a widely used collection of business applications.

Defused honeypot detections

Defused, which operates honeypots to capture malicious activity in non-production environments, recorded six instances of exploitation during a two-hour window on a Saturday. The firm attributed the attempts to a single IP address and emphasized that the activity occurred before public proof-of-concepts were available — a timing detail that led Kohonen to characterize the behavior as reconnaissance and weaponization testing rather than a focused assault on a named victim.

Shadowserver's scan of Oracle E-Business Suite

Independent scanning by Shadowserver found roughly 950 potentially vulnerable Oracle E-Business Suite instances as of Wednesday. More than half of those publicly exposed deployments are based in the United States, according to the scan results reported alongside the exploitation findings. The presence of hundreds of reachable instances raises the scope for potential expansion beyond the narrow pattern Defused observed.

Connections to Clop and ShinyHunters incidents

The payments-processing defect sits in an application family that attackers have exploited before. Last year, the Clop ransomware group exploited a zero-day and other vulnerabilities in Oracle E-Business Suite and then attempted to extort dozens of victims. Reporting said Clop’s aggressive extortion campaign began in October, roughly two months after the group exploited the defect and stole data en masse.

Separately, Oracle customers were hit by an actively exploited zero-day in PeopleSoft this spring. The group ShinyHunters, which investigators tied to that PeopleSoft activity dating back to late May, potentially infiltrated the networks of more than 100 organizations, mostly in higher education, according to Mandiant and Google Threat Intelligence Group. Those prior incidents demonstrate recent, successful targeting of Oracle-branded enterprise applications and the follow-on consequences for victims.

What this means for technologists, Oracle customers, and higher education

  • Technologists and security teams: The Defused detections — six attempts from one IP in two hours, before public proof-of-concepts — suggest early-stage reconnaissance and weaponization activity to monitor. Given Oracle’s note that exploitation complexity is low, teams responsible for Oracle E-Business Suite should prioritize verifying patch status for CVE-2026-46817 and monitoring for similar scanning and exploit patterns.
  • Oracle customers and procurement leaders: Shadowserver’s scan showing about 950 potentially vulnerable, publicly exposed instances, with more than half in the United States, underscores the operational reach of the issue and the value of rapid patch deployment and exposure reduction for internet-facing systems.
  • Higher education institutions: Reporting tied ShinyHunters’ PeopleSoft activity to potential incursions at more than 100 organizations, mostly in higher education, a reminder that academic networks can be common targets for attackers exploiting enterprise application flaws.

The recorded activity so far reads like early-stage testing, but the combination of a high-severity, low-complexity vulnerability, hundreds of potentially exposed instances, and a recent history of successful exploit-driven extortion and data theft leaves a narrow margin for complacency. Whether this single-IP probe will broaden into widespread exploitation — and if it will follow the pattern of swift extortion and data exposure seen in prior incidents — remains the immediate question for defenders.

Original reporting: https://cyberscoop.com/oracle-ebs-critical-vulnerability-exploited/

Emerging ThreatsReconnaissanceThreat IntelligenceVulnerability ManagementExploit DevelopmentCVE-2026-46817Oracle ExploitE-Business SuitePayments Processing
Related Intelligence

Continue Reading

A lone computer workstation sits in a vast, empty IT room with rows of server racks in the background.

CISA Warns of Active SharePoint RCE Exploitation

CISA warns that a high-severity vulnerability in Microsoft SharePoint Server, known as CVE-2026-45659, is being actively exploited, allowing authorized attackers to execute code remotely. This critical flaw, patched by Microsoft in May, requires immediate attention to prevent network breaches.

Analyst 207
Hospital corridor with medical devices and blurred computer equipment.

Medtronic Data Breach Exposes 9 Million Records to Hackers

Medtronic recently discovered a data breach that put 9 million records at risk of being accessed by hackers, sparking a thorough investigation and prompt notification of affected customers. The breach, which occurred between April 13 and April 19, 2026, exposed sensitive personal data to an unauthorized third party.

Analyst 207
Cluttered office desk with open laptop, invoices, and scattered papers showing signs of disruption.

EvilTokens Phishing Kit Exposes Sophisticated Evasion Tactics

Microsoft VP of security research Tanmay Ganacharya revealed that 10-15 distinct EvilTokens phishing campaigns have been launching daily since March 15, 2026, showcasing the alarming speed at which device-code phishing operations have scaled. This comes as Cisco Talos incident responders uncovered a targeted phishing chain that abused a real vendor relationship using an outstanding-invoice lure.

Analyst 207
Rows of rack-mounted servers and equipment in a brightly-lit server room or data center interior.

FortiBleed Campaign Tied to Lynx Ransomware Operators

Researchers uncovered a massive credential-theft operation, dubbed FortiBleed, which exposed over 73,000 Fortinet device credentials and was surprisingly linked to active ransomware negotiation panels. This shocking discovery offers a rare glimpse into the tactics of threat actors.

Analyst 207