{"id":89675,"date":"2026-07-01T15:23:26","date_gmt":"2026-07-01T19:23:26","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?p=89675"},"modified":"2026-07-01T15:23:29","modified_gmt":"2026-07-01T19:23:29","slug":"oracle-ebs-critical-vulnerability-exploited","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/","title":{"rendered":"Researchers spot exploitation of another critical Oracle defect"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A cybercriminal exploited a critical defect Saturday in the payments processing feature of Oracle E-Business Suite that could mark the early stages of a potentially broader campaign, researchers said.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Defused, a threat intelligence firm, spotted six instances of exploitation during a two-hour window on its honeypots, or decoys designed to monitor malicious activity in non-production environments, Simo Kohonen, founder and CEO of the company, told CyberScoop.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Oracle <a href=\"https:\/\/www.oracle.com\/security-alerts\/cspumay2026.html\">disclosed and patched<\/a> the vulnerability, which is tracked as <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-46817\">CVE-2026-46817<\/a> with a 9.8 severity rating, in late May and warned that exploitation complexity is low.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kohonen said the exploits were attributed to a single IP address and occurred before any proof-of-concepts were publicly available.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWith only one IP and one day of data, it reads more like reconnaissance and weaponization testing than a targeted campaign against a specific victim,\u201d he added.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The potential expansion of malicious activity on live networks could be significant. Shadowserver scans found <a href=\"https:\/\/dashboard.shadowserver.org\/statistics\/iot-devices\/time-series\/?date_range=other_range&amp;d1=2026-06-27&amp;d2=2026-06-30&amp;vendor=oracle&amp;model=oracle+e-business+suite&amp;dataset=count&amp;limit=10000&amp;group_by=geo&amp;stacking=stacked&amp;auto_update=on\">about 950 potentially vulnerable instances<\/a> of Oracle E-Business Suite on Wednesday, and more than half of those publicly exposed deployments are based in the United States.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The notorious Clop ransomware group attempted to extort <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-customers-attacks-clop-google-mandiant\/\">dozens of victims<\/a> after it exploited a zero-day and other vulnerabilities in Oracle E-Business Suite last year. The aggressive extortion campaign got underway in October, roughly two months after Clop exploited the defect and stole data en masse.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Oracle customers were more recently impacted by an actively exploited <a href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-peoplesoft-zero-day-vulnerability-shinyhunters-extortion\/\">zero-day vulnerability in PeopleSoft<\/a>, which includes more than 40 tools for human resources and customer relationship management.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ShinyHunters, the group behind that attack spree dating back to late May, potentially infiltrated the networks of more than 100 organizations mostly in higher education, according to Mandiant and Google Threat Intelligence Group.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.<\/p>\n","protected":false},"author":662,"featured_media":86300,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":""},"categories":[5974,6503,6825],"tags":[443,2869,5892,7221,8660],"people":[],"special-report":[],"authors":[7657],"class_list":["post-89675","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-threats","category-research","category-cybersecurity","tag-cybercrime","tag-oracle","tag-exploit","tag-vulnerability","tag-defused","author-matt-kapko"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.8 (Yoast SEO v27.8) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Researchers spot exploitation of another critical Oracle defect | CyberScoop<\/title>\n<meta name=\"description\" content=\"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Researchers spot exploitation of another critical Oracle defect\" \/>\n<meta property=\"og:description\" content=\"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/\" \/>\n<meta property=\"og:site_name\" content=\"CyberScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-01T19:23:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-01T19:23:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"6048\" \/>\n\t<meta property=\"og:image:height\" content=\"4024\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Matt Kapko\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@CyberScoopNews\" \/>\n<meta name=\"twitter:site\" content=\"@CyberScoopNews\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/\",\"name\":\"Researchers spot exploitation of another critical Oracle defect | CyberScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2025\\\/10\\\/GettyImages-2205578283-min.jpg\",\"datePublished\":\"2026-07-01T19:23:26+00:00\",\"dateModified\":\"2026-07-01T19:23:29+00:00\",\"description\":\"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2025\\\/10\\\/GettyImages-2205578283-min.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2025\\\/10\\\/GettyImages-2205578283-min.jpg\",\"width\":6048,\"height\":4024,\"caption\":\"Oracle (Getty Images)\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/oracle-ebs-critical-vulnerability-exploited\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Researchers spot exploitation of another critical Oracle defect\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"name\":\"CyberScoop\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#organization\",\"name\":\"CyberScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/wp-content\\\/uploads\\\/sites\\\/3\\\/2023\\\/01\\\/CyberScoop-Black.png\",\"width\":1545,\"height\":186,\"caption\":\"CyberScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/cyberscoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cyberscoop\\\/\",\"https:\\\/\\\/x.com\\\/CyberScoopNews\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cyberscoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCDG2jjHiZ8r97MCVnsaAkXw\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Researchers spot exploitation of another critical Oracle defect | CyberScoop","description":"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/","og_locale":"en_US","og_type":"article","og_title":"Researchers spot exploitation of another critical Oracle defect","og_description":"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/","og_site_name":"CyberScoop","article_publisher":"https:\/\/www.facebook.com\/cyberscoop\/","article_published_time":"2026-07-01T19:23:26+00:00","article_modified_time":"2026-07-01T19:23:29+00:00","og_image":[{"width":6048,"height":4024,"url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg","type":"image\/jpeg"}],"author":"Matt Kapko","twitter_card":"summary_large_image","twitter_creator":"@CyberScoopNews","twitter_site":"@CyberScoopNews","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/","name":"Researchers spot exploitation of another critical Oracle defect | CyberScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg","datePublished":"2026-07-01T19:23:26+00:00","dateModified":"2026-07-01T19:23:29+00:00","description":"The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.","breadcrumb":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg","width":6048,"height":4024,"caption":"Oracle (Getty Images)"},{"@type":"BreadcrumbList","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/oracle-ebs-critical-vulnerability-exploited\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/"},{"@type":"ListItem","position":2,"name":"Researchers spot exploitation of another critical Oracle defect"}]},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","name":"CyberScoop","description":"","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#organization","name":"CyberScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2023\/01\/CyberScoop-Black.png","width":1545,"height":186,"caption":"CyberScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cyberscoop\/","https:\/\/x.com\/CyberScoopNews","https:\/\/www.linkedin.com\/company\/cyberscoop\/","https:\/\/www.youtube.com\/channel\/UCDG2jjHiZ8r97MCVnsaAkXw"]}]}},"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"CyberScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-content\/uploads\/sites\/3\/2025\/10\/GettyImages-2205578283-min.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/89675","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/users\/662"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/comments?post=89675"}],"version-history":[{"count":2,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/89675\/revisions"}],"predecessor-version":[{"id":89677,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/posts\/89675\/revisions\/89677"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media\/86300"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/media?parent=89675"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/categories?post=89675"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/tags?post=89675"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/people?post=89675"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/special-report?post=89675"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/cyberscoop\/wp-json\/wp\/v2\/authors?post=89675"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}