Oracle EBS attacked with private exploit before public patch

What happened?

On June 27, 2026, researchers from Defused detected the first known exploitation of CVE-2026-46817, a critical vulnerability (CVSS 9.8) in the Oracle Payments File Transmission component of Oracle E-Business Suite (EBS) versions 12.2.3 to 12.2.15. Oracle had released a patch in its May 2026 Critical Patch Update (CPU), but attackers began exploiting it just six weeks later, before any public proof-of-concept was available.

According to Defused, the attacks were not a mass scan but six targeted attempts from a single IP source, likely to test or validate the exploit. The requests sought to read sensitive server files, such as configurations or credentials, suggesting an attacker with access to a private exploit, either through reverse engineering the patch or purchasing it on underground markets. This pattern of selective exploitation indicates the attacker was not seeking broad compromise but testing the exploit's effectiveness before potential wider use.

The vulnerability allows unauthenticated attackers to read arbitrary files from the server, potentially exposing critical data such as passwords, database configurations, or encryption keys. The Shadowserver Foundation estimates there are around 950 exposed EBS instances on the internet, primarily in the United States, though not all are vulnerable. However, the existence of functional exploits significantly increases the risk for organizations that have not applied the patch.

Why is it important?

Oracle E-Business Suite is an ERP used by thousands of global companies to manage finances, supply chain, human resources, and other critical operations. A vulnerability in the Payments module can expose financial and transaction data, making it a high-value target for cybercriminals.

This incident adds to a worrying trend: the window between patch release and active exploitation is shrinking dramatically. In June 2026, the ShinyHunters group exploited a zero-day vulnerability in PeopleSoft (another Oracle product) before patches were widely deployed, compromising over 100 organizations and stealing HR and payroll data. Additionally, the Clop group conducted a prolonged campaign against exposed EBS servers in 2025, demonstrating that ERPs are a recurring target.

The attack also highlights a systemic issue: security patches can become a roadmap for attackers. By analyzing differences between patched and unpatched versions, cybercriminals can pinpoint exactly where the vulnerability lies and develop exploits before organizations apply the update. This phenomenon, known as the patch gap, has been observed in other products like Microsoft Exchange and Apache Log4j, but now affects critical enterprise software like Oracle EBS.

The potential impact is enormous: according to Oracle data, EBS is used by over 12,000 customers worldwide, including large corporations and governments. A successful exploit could enable theft of financial data, operational disruption, or even access to connected systems. Moreover, the targeted nature of the attack suggests threat actors are investing in custom exploits, increasing the sophistication of threats.

Consequences and recommendations

Companies using Oracle EBS should apply the May 2026 patch immediately if they haven't already. Since the exploit is already in circulation, any unpatched instance is vulnerable. Additionally, they should review access logs for exploitation attempts, especially in the Payments module. The window between patch release and active exploitation is narrowing, demanding more agile and automated patch management.

Researchers recommend not exposing EBS interfaces to the internet without additional protection, such as VPNs, access control lists (ACLs), or multi-factor authentication. Furthermore, monitoring anomalous traffic and implementing intrusion detection systems (IDS) can help mitigate risks. It is crucial to segment the network to limit access to ERP systems and apply the principle of least privilege.

For organizations that cannot patch immediately, it is suggested to implement firewall rules to block access to the Payments component from untrusted IP addresses, as well as enable detailed event logging to facilitate detection of suspicious activity. Periodic penetration testing is also recommended to identify vulnerabilities before attackers do.

“Security patches have become a double-edged sword: they fix vulnerabilities, but also reveal to attackers where the cracks are.” – Analyst at TheVortiq

What should readers know?

If your organization uses Oracle E-Business Suite, verify that the version is patched with the May 2026 update. Consider that attackers already have functional exploits and can strike at any time. ERP security must be a priority, as financial and HR data are high-value targets. This incident underscores the need for a proactive security strategy that includes rapid patching, network segmentation, and continuous monitoring.

In a broader context, companies must prepare for a scenario where critical patches become moving targets. Collaboration with incident response teams and threat intelligence sharing can help anticipate attacks. As The Register notes, enterprise software has become a lucrative hunting ground for cybercriminals, and critical updates can serve as roadmaps for those willing to reverse-engineer fixes and get ahead of customers in deployment.