InfoSecBulletin Cybersecurity for mankind
The Shadowserver Foundation found about 950 Oracle E-Business Suite (EBS) systems on the internet around the world. This discovery came after they improved their fingerprinting method with help from Validin LLC.
The new detection method now uses both domain scanning and regular IP scanning. It has found active attacks using a serious weakness called CVE-2026-46817. DefusedCyber says that there are already attempts to exploit CVE-2026-46817.
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Oracle E-Business Suite Instances Exposed
While Shadowserver’s scan results show numbers of exposed systems instead of confirmed security breaches, the presence of active attack traffic against a commonly used business software raises big worries for organizations using unpatched EBS systems.
Oracle E-Business Suite is a complete ERP solution that companies around the world use to handle finance, supply chain, human resources, and customer relationships.
Shadowserver’s updated Device ID reporting now flags exposed EBS instances under the classification device_vendor: Oracle, device_model: Oracle E-Business Suite.
A world map from Shadowserver shows where exposed instances are found. It uses a special scale to show the data.
This exposure count shows only how visible something is on the internet. It doesn’t mean there is a security problem. Not every visible instance is unpatched or at risk for CVE-2026-46817.
Oracle has provided repair advice through its Critical Patch Update channel, specifically noting the May 2026 Critical Patch Update Security Alert.
Organizations using Oracle E-Business Suite are strongly encouraged to check this advisory right away to see if the patch applies to their version.
Mitigation
Security teams managing Oracle EBS deployments should take the following steps:
Apply Oracle’s May 2026 Critical Patch Update without delay, prioritizing internet-facing instances.
Cross-reference exposure data via Shadowserver’s dashboard or direct constituency reporting to identify at-risk assets.
Restrict internet-facing access to EBS instances where feasible, using VPNs or IP allowlisting as compensating controls.
Given the active exploitation status and the sensitive nature of data typically housed within ERP systems, organizations should treat this disclosure as time-critical and prioritize patching over routine maintenance cycles.
