Skip to content

Researchers spot exploitation of another critical Oracle defect

Chimera readability score 78 out of 100, Expert reading level.

A cybercriminal exploited a critical defect Saturday in the payments processing feature of Oracle E-Business Suite that could mark the early stages of a potentially broader campaign, researchers said.
Defused, a threat intelligence firm, spotted six instances of exploitation during a two-hour window on its honeypots, or decoys designed to monitor malicious activity in non-production environments, Simo Kohonen, founder and CEO of the company, told CyberScoop.
Oracle disclosed and patched the vulnerability, which is tracked as CVE-2026-46817 with a 9.8 severity rating, in late May and warned that exploitation complexity is low.
Kohonen said the exploits were attributed to a single IP address and occurred before any proof-of-concepts were publicly available.
“With only one IP and one day of data, it reads more like reconnaissance and weaponization testing than a targeted campaign against a specific victim,” he added.
The potential expansion of malicious activity on live networks could be significant. Shadowserver scans found about 950 potentially vulnerable instances of Oracle E-Business Suite on Wednesday, and more than half of those publicly exposed deployments are based in the United States.
The defect impacts a popular collection of business applications that attackers have hit before in widespread attack sprees.
The notorious Clop ransomware group attempted to extort dozens of victims after it exploited a zero-day and other vulnerabilities in Oracle E-Business Suite last year. The aggressive extortion campaign got underway in October, roughly two months after Clop exploited the defect and stole data en masse.
Oracle customers were more recently impacted by an actively exploited zero-day vulnerability in PeopleSoft, which includes more than 40 tools for human resources and customer relationship management.
ShinyHunters, the group behind that attack spree dating back to late May, potentially infiltrated the networks of more than 100 organizations mostly in higher education, according to Mandiant and Google Threat Intelligence Group.

Sentinel — Human

Confidence

The text presents a high level of specific, interconnected threat intelligence, strongly suggesting it is human-sourced investigative reporting rather than purely synthetic generation.

Signals Detected
low severity: Sentence structure exhibits variance and journalistic rhythm; not the uniform metronomic flow typical of pure LLM generation.
low severity: The text demonstrates strong, specific internal coherence by linking multiple disparate threat intelligence sources (Clop, ShinyHunters, Mandiant) into a cohesive narrative, which is characteristic of human investigative reporting.
low severity: Attribution relies on specific, verifiable entities (Mandiant, Google Threat Intelligence Group, Defused) and specific CVE numbers, suggesting source-driven synthesis rather than generic LLM confabulation.
low severity: The claims are highly technical and rooted in known threat actor history (Clop, PeopleSoft), making easy fabrication difficult without specific intent to deceive verified sources.
Human Indicators
Specific attribution of statistics and quotes to named threat intelligence firms and individuals (Simo Kohonen, Mandiant, Google Threat Intelligence Group).
Integration of historical attack data (Clop ransomware) into the current event narrative.
The nuanced discussion distinguishing between 'reconnaissance' and 'targeted campaign' based on limited data.