950 Oracle E-Business Suite Instances Exposed as CVE-2026-46817 Attacks Observed in the Wild

Around 950 internet-facing Oracle E-Business Suite (EBS) instances have been identified as exposed following enhanced scanning efforts. At the same time, active exploitation attempts tied to CVE-2026-46817 have already been observed in the wild.

The findings were disclosed by The Shadowserver Foundation, which recently expanded its fingerprinting capabilities through domain-based scanning in collaboration with Validin.

This improvement has enabled broader visibility into externally accessible Oracle EBS deployments, a critical enterprise resource planning platform widely used across large organizations.

950 Oracle E-Business Suite Instances Exposed

According to Shadowserver, the identified systems are not necessarily confirmed as vulnerable, as no direct vulnerability assessment was performed during the scan.

However, their exposure significantly increases the attack surface, especially given the emergence of exploitation activity linked to CVE-2026-46817.

Security researchers at DefusedCyber reported observing real-world attack attempts targeting this flaw, indicating that threat actors are actively probing for and potentially exploiting unpatched systems.

CVE-2026-46817, listed in the National Vulnerability Database (NVD), affects Oracle E-Business Suite components and is addressed in Oracle’s May 2026 Critical Patch Update (CPU).

While detailed technical specifics remain limited in public disclosures, the vulnerability is considered severe due to its potential impact on enterprise environments.

Oracle EBS systems often handle sensitive financial, HR, and operational data, making them high-value targets for attackers seeking initial access, data exfiltration, or lateral movement within corporate networks.

The exposure data released by Shadowserver includes global distribution insights, accessible via its public dashboard, which maps Oracle EBS instances detected through its scanning infrastructure.

Additionally, affected organizations and network operators can leverage Shadowserver’s Device ID reporting service, which provides IP-level visibility into potentially exposed assets categorized under “device_vendor: Oracle” and “device_model: Oracle E-Business Suite.”

This intelligence enables defenders to identify externally reachable systems within their infrastructure quickly.

From an attack perspective, exposed enterprise applications such as Oracle EBS are often targeted through automated scanning, credential attacks, or the exploitation of unpatched vulnerabilities.

The observation of CVE-2026-46817 exploitation attempts suggests that attackers are already integrating this flaw into their reconnaissance and exploitation workflows. In many cases, opportunistic threat actors rapidly weaponize newly disclosed vulnerabilities, particularly when public exposure of targets is high.

Oracle has released patches to address this vulnerability as part of its official security advisory, and organizations are strongly advised to apply the updates immediately.

In addition to patching, security teams should restrict external access to EBS instances, enforce strong authentication mechanisms, and monitor logs for suspicious activity indicative of exploitation attempts. Network segmentation and web application firewall (WAF) protections can further reduce risk.

The combination of widespread exposure and confirmed in-the-wild exploitation attempts underscores the urgency for organizations to assess their Oracle E-Business Suite deployments.

With hundreds of instances publicly accessible and attackers actively scanning, delayed remediation could lead to significant security incidents, including data breaches and operational disruption.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN