Critical Oracle E-Business Suite Flaw Exploited for Unauthenticated Takeover
Attackers are actively exploiting CVE-2026-46817, a critical 9.8 severity flaw in the Oracle Payments File Transmission component of Oracle E-Business Suite. The vulnerability affects EBS versions 12.2.3 through 12.2.15 and allows unauthenticated attackers with HTTP access to compromise confidentiality, integrity, and availability on vulnerable systems. Oracle addressed the issue in its May 2026 Critical Patch Update and urged customers to apply fixes immediately.
Security researchers observed in-the-wild exploitation against Oracle EBS honeypots, including crafted POST requests to the /OA_HTML/ibytransmit endpoint with XML payloads abusing the CODEX_PULL transmission scheme. The activity reportedly attempted to read /etc/passwd, pointing to a local file read or path traversal exploitation chain, and occurred despite no known public proof-of-concept, suggesting private exploit tooling. Internet scanning data indicates more than 450 exposed Oracle EBS instances remain reachable, with attack activity recorded across multiple regions, including North America, Europe, and Asia.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Shadowserver tracks roughly 950 exposed Oracle EBS instances
BleepingComputer reported that Shadowserver was tracking roughly 950 internet-exposed Oracle E-Business Suite instances amid ongoing exploitation of CVE-2026-46817. The report said it was unclear how many of those exposed systems remained vulnerable to the flaw.
Shadowserver records 456 attack hits targeting exposed Oracle EBS
Shadowserver telemetry recorded 456 attack hits on June 28, 2026, targeting internet-exposed Oracle E-Business Suite instances across multiple regions, with North America and Asia leading. Separate reporting also noted more than 450 exposed Oracle EBS instances being tracked, though patch status was unclear.
Defused observes exploitation of Oracle EBS flaw on honeypots
Defused observed active exploitation of CVE-2026-46817 against Oracle E-Business Suite honeypots during June 27-28, 2026. The activity included targeted POST requests to the /OA_HTML/ibytransmit endpoint with crafted XML payloads abusing the CODEX_PULL transmission scheme and attempting to read /etc/passwd.
Oracle patches CVE-2026-46817 in Critical Patch Update
Oracle fixed CVE-2026-46817, a critical vulnerability in the Oracle Payments File Transmission component of Oracle E-Business Suite, in its May 2026 Critical Patch Update. One reference explicitly dates this patch release to May 28, 2026.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
11 references tracked. Mallory keeps watching after this page renders.
Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released
theregister.com
Open sourceOracle E-Business Suite Flaw Under Active Attack, 950 Systems Exposed
securityaffairs.com
Open sourceResearchers spot exploitation of another critical Oracle defect | CyberScoop
cyberscoop.com
Open sourceOver 900 Oracle E-Business instances exposed to ongoing attacks
bleepingcomputer.com
Open sourceOracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
thehackernews.com
Open sourceOracle E-Business Suite Payments flaw under attack (CVE-2026-46817) - Help Net Security
helpnetsecurity.com
Open sourceHackers Exploiting Critical Oracle E-Business Suite Vulnerability Actively in Attacks - Cyber Security News
cybersecuritynews.com
Open sourceHackers now exploit critical Oracle E-Business flaw in attacks
bleepingcomputer.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle E-Business Suite Zero-Day Exploited for Remote Code Execution and Data Theft
Oracle E-Business Suite (EBS) was found to contain a critical zero-day vulnerability, tracked as CVE-2025-61884 and CVE-2025-61882, which allowed unauthenticated remote code execution and was actively exploited by threat actors, including the Clop ransomware group. The vulnerability, present in EBS versions 12.2.3 through 12.2.14, enabled attackers to access sensitive resources without authentication by exploiting a pre-authentication Server-Side Request Forgery (SSRF) flaw. Oracle released an out-of-band security update to address the issue, but did so without publicly acknowledging that the flaw was being actively exploited or that a proof-of-concept exploit had been leaked by the ShinyHunters extortion group. Security researchers and customers confirmed that the patch addressed the SSRF vulnerability used in the attacks. The exploit chain was complex, involving an unauthenticated HTTP POST to a specific servlet, manipulation of return_url parameters to trigger SSRF, CRLF/header injection, HTTP connection reuse, and ultimately the delivery of a malicious XSL stylesheet. This XSLT payload, containing embedded Java code, was processed by the server, leading to arbitrary code execution and the potential for attackers to spawn reverse shells. The Clop ransomware group sent extortion emails to Oracle EBS customers, claiming to have stolen sensitive data by exploiting this flaw, and confirmed their involvement in the campaign. The attack campaign was detected by Mandiant and Google, who observed that multiple threat actors were leveraging the vulnerability for data theft and extortion. The exploit chain demonstrated the risk of chaining multiple weaknesses in enterprise software to achieve full remote code execution. Security vendors, such as Imperva, responded by confirming protection for their customers against this exploit. The incident highlighted Oracle's lack of transparency regarding active exploitation and the public availability of exploit code. The technical details of the exploit, including SSRF, CRLF injection, and XSLT-based code execution, underscored the sophistication of the attack. The vulnerability's exploitation in the wild emphasized the importance of rapid patching and monitoring for signs of compromise in Oracle EBS environments. The campaign also illustrated the ongoing threat posed by ransomware and extortion groups targeting critical business applications. Organizations using Oracle EBS were urged to apply the security update immediately and review their systems for indicators of compromise. The incident raised concerns about the security of widely used enterprise resource planning (ERP) platforms and the need for proactive vulnerability management.
Jun 29, 2026
Critical Remote Code Execution Vulnerability in Oracle E-Business Suite Exploited by Clop Ransomware
Oracle E-Business Suite (EBS) was found to contain a critical remote code execution (RCE) vulnerability, tracked as CVE-2025-61882, which has been actively exploited in the wild. The flaw resides in the Oracle Concurrent Processing component, specifically within the BI Publisher Integration, and carries a CVSS base score of 9.8 due to its unauthenticated and easily exploitable nature. Attackers can leverage this vulnerability to execute arbitrary code remotely without requiring valid credentials, posing a severe risk to organizations running affected EBS versions. Oracle confirmed that versions 12.2.3 through 12.2.14 are impacted by this vulnerability. The company released an emergency security update to address the issue, but customers must first apply the October 2023 Critical Patch Update before deploying the new fix. The vulnerability was exploited by the Clop ransomware group in a series of data theft attacks in August 2025, resulting in significant data exfiltration from multiple victims. Mandiant's CTO, Charles Carmakal, confirmed that Clop leveraged both this zero-day and other previously patched vulnerabilities in their campaign. Oracle's advisory included indicators of compromise that matched exploit details shared by threat actors on Telegram, highlighting the public availability of exploit information. The exploitation of this flaw underscores the importance of timely patch management, especially for business-critical applications like Oracle EBS. Oracle has urged all customers to prioritize the application of the latest patches to mitigate the risk of further exploitation. The incident demonstrates the increasing trend of ransomware groups targeting enterprise software vulnerabilities for large-scale data theft. Security researchers have emphasized the need for organizations to monitor for signs of compromise and to review their EBS deployments for unauthorized activity. The rapid release of a security alert and patch by Oracle reflects the urgency and severity of the threat posed by CVE-2025-61882. Organizations are advised to follow Oracle's remediation guidance closely and to remain vigilant for related threat activity. The incident has raised concerns about the security posture of widely used ERP platforms and the potential for future exploitation of similar vulnerabilities. The Clop attacks serve as a reminder that threat actors are adept at chaining multiple vulnerabilities to maximize impact. This event highlights the criticality of maintaining up-to-date security controls and monitoring for exploitation attempts targeting high-value enterprise systems.
Jun 29, 2026
Oracle E-Business Suite 0-Day Vulnerability and Dark Web Exploit Activity
Oracle has issued a security alert regarding a newly discovered high-severity vulnerability in its E-Business Suite (EBS), tracked as CVE-2025-61884, which allows remote, unauthenticated attackers to gain access to sensitive resources. The flaw affects Oracle Configurator, a component used for automating product and service configuration, and impacts versions 12.2.3 through 12.2.14 of EBS. According to Oracle’s chief security officer, the vulnerability is easily exploitable via HTTP and could result in unauthorized access to critical or all data accessible through Oracle Configurator. The National Institute of Standards and Technology (NIST) has classified this as a high-risk issue, emphasizing the potential for attackers to compromise entire EBS environments without credentials. This vulnerability follows closely on the heels of another zero-day (CVE-2025-61882) disclosed by Oracle the previous week, indicating a concerning trend of critical flaws in the EBS platform. Security researchers have noted that the Cl0p ransomware group previously exploited EBS vulnerabilities to gain unauthorized access to corporate accounts, raising the risk that this new flaw could be weaponized by similar threat actors. Concurrently, dark web monitoring teams have observed the sale of an alleged 0-day exploit for Oracle E-Business Suite on underground forums, suggesting that cybercriminals are actively seeking to monetize this vulnerability. The dark web activity includes discussions and advertisements for the Oracle EBS 0-day, alongside other high-profile data leaks and exploit sales, highlighting the immediate interest from the cybercriminal community. Organizations using affected versions of Oracle EBS are urged to apply patches or mitigations as soon as they become available and to monitor for signs of exploitation. The exposure of such a critical business application to unauthenticated remote attacks significantly increases the risk of data breaches, ransomware, and business disruption. Security teams should prioritize reviewing access logs, implementing network segmentation, and restricting external access to Oracle EBS interfaces. The rapid appearance of exploit sales on the dark web underscores the urgency of the threat and the likelihood of imminent exploitation in the wild. Oracle customers are advised to stay informed through official security advisories and to coordinate with their IT and security vendors for timely remediation. The incident demonstrates the ongoing targeting of enterprise software by both sophisticated ransomware groups and opportunistic cybercriminals. Proactive defense and rapid response are essential to mitigate the risks posed by this and similar vulnerabilities in widely deployed business platforms.
Jun 29, 2026