Over 900 Oracle E-Business Suite Instances Under Active Attack

Security researchers have confirmed that over 900 Oracle E-Business Suite (EBS) instances are exposed to the internet and under active attack, with adversaries actively exploiting a critical security flaw in the widely-deployed enterprise platform. If you run EBS, this is not a watch-and-wait situation.

What Happened

Attackers are actively scanning for and compromising publicly accessible Oracle EBS deployments by leveraging a critical vulnerability. Over 900 internet-facing instances have been identified as exposed — meaning the exploitation window is open right now, not theoretical. The attack campaign is ongoing.

Why It Matters

Oracle E-Business Suite is a backbone system for thousands of enterprises, handling financials, HR, procurement, supply chain, and manufacturing data. A compromised EBS instance hands attackers access to some of the most sensitive data an organization holds: payroll records, vendor payment details, employee PII, and financial reporting.

Unlike edge services, EBS environments are typically connected deeply to internal networks. Once an attacker establishes a foothold, lateral movement is far easier than in an isolated perimeter service. The combination of high data sensitivity, deep internal connectivity, and active exploitation makes this particularly dangerous.

The fact that exploitation is ongoing rather than merely disclosed changes the calculus. This is a breach campaign in progress, not a future risk.

What to Do

1. Audit internet exposure immediately. Oracle EBS should never be directly internet-facing without a properly configured WAF or reverse proxy. If your EBS is reachable on a public IP, pull it behind your perimeter now — before patching.

2. Apply Oracle's latest Critical Patch Update. Oracle releases quarterly CPUs. Verify you are running current patches, specifically any addressing EBS components. Check Oracle's security advisories for the relevant CVE and confirm your patch level today.

3. Review access logs for signs of compromise. Look for unusual authentication attempts, unexpected API calls to EBS endpoints, and anomalous activity going back at least 30 days. Assume you may already be compromised until proven otherwise.

4. Restrict network access at the perimeter. Enforce IP allowlisting so only known, expected ranges can reach EBS services. Disable any EBS modules or services not actively in use to reduce attack surface.

5. Audit for unauthorized accounts. Attackers with initial access frequently create backdoor accounts. Run a full audit of your EBS user database and compare against your known-good baseline.

If you are an Oracle EBS administrator who has not reviewed patch level and network exposure in the last 48 hours, treat this as an emergency response, not a scheduled maintenance item.