More than 900 Oracle E‑Business Suite instances have been found exposed on the public internet. At the same time, attackers actively exploit a critical vulnerability in the platform, putting mission‑critical ERP environments at immediate risk of compromise.

Recent scanning data from security researchers shows that over 900 Oracle E‑Business Suite (EBS) servers are directly reachable from the internet rather than being segmented behind VPNs or private networks, significantly increasing their attack surface.

Shadowserver reports that it is now tracking roughly 950 Oracle EBS instances online after enhancing its fingerprinting methodology with domain‑based scanning in addition to traditional IP‑based probes.

We have improved our Oracle E-Business Suite fingerprinting by adding domain based scans in collaboration with @ValidinLLC. Around 950 exposed instances now seen globally (no vulnerability assessment). CVE-2026-46817 attempts have been observed in the wild by @DefusedCyber pic.twitter.com/gghdTt5b1X
— The Shadowserver Foundation (@Shadowserver) July 1, 2026

The exposed instances are being targeted through a newly disclosed critical Oracle E‑Business vulnerability that enables remote attackers to execute arbitrary code and potentially gain full control over the impacted application stack.

Researchers warn that exploitation is already ongoing in the wild, meaning attackers are not just scanning but actively attempting to leverage the flaw against internet‑facing EBS servers.

Oracle E‑Business Suite is widely used for finance, supply chain, HR, and other core back‑office processes, so successful exploitation can grant attackers access to highly sensitive transactional and operational data.

World Map view of exposed EBS instances( source : x) — World Map view of exposed EBS instances (source: ShadoServer)

Because many of the identified instances involve large enterprises and service providers, a compromise could lead to data theft, manipulation of financial records, disruption of logistics, or lateral movement deeper into corporate networks.

Internet‑Exposed Oracle E‑Business Instances

According to the Shadowserver Foundation, internet scans have identified exposed Oracle EBS instances that are being targeted in active exploitation attempts.

Its upgraded scanning, developed in collaboration with Validin LLC, allowed more accurate discovery of EBS deployments by matching domain signatures and specific application fingerprints rather than relying solely on IP‑level banners.

Organizations running Oracle E‑Business Suite are urged to immediately identify any instances that are reachable from the public internet and move them behind secure access controls, such as VPNs or zero‑trust gateways.

Administrators should apply the latest Oracle security patches that address the actively exploited vulnerability, verify that all middleware components are up to date, and monitor logs for indicators of compromise or unusual activity.

In addition to patching, hardening Oracle E‑Business deployments should include enforcing strong authentication, turning off unnecessary services, implementing web application firewalls, and conducting regular external exposure assessments.

Security teams are advised to treat all exposed Oracle EBS instances as high‑priority risk assets, assume potential probing by threat actors, and integrate relevant detection rules into SIEM and EDR platforms for rapid incident response.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post 900+ Oracle E-Business instances Exposed Online Amid Active Vulnerability Exploitation appeared first on Cyber Security News.