The Shadowserver Foundation has identified approximately 950 internet-exposed Oracle E-Business Suite (EBS) instances worldwide, following an upgrade to its fingerprinting methodology developed in collaboration with Validin LLC.
The improved detection technique, which now incorporates domain-based scanning alongside traditional IP-based methods, has surfaced active exploitation attempts targeting a critical vulnerability tracked as CVE-2026-46817.
According to threat intelligence shared by DefusedCyber, active exploitation attempts against CVE-2026-46817 have already been observed.
Oracle E-Business Suite Instances Exposed
While Shadowserver’s scan results reflect exposure counts rather than confirmed compromise, the presence of live attack traffic against a widely deployed enterprise resource planning platform raises significant concern for organizations running unpatched EBS environments.
Oracle E-Business Suite is a comprehensive ERP solution used by enterprises globally to manage finance, supply chain, human resources, and customer relationship functions.
Its broad adoption across large organizations, combined with its role in processing sensitive financial and operational data, makes it a high-value target for threat actors seeking either direct financial gain or a foothold for lateral movement within corporate.
Shadowserver’s updated Device ID reporting now flags exposed EBS instances under the classification device_vendor: Oracle, device_model: Oracle E-Business Suite.
A publicly accessible world map published by Shadowserver visualizes the global distribution of exposed instances on a logarithmic scale.
It’s important to note that this exposure count reflects internet-facing visibility only and does not constitute a vulnerability assessment; not every exposed instance is necessarily unpatched or vulnerable to CVE-2026-46817.
Oracle has issued remediation guidance through its Critical Patch Update channel, specifically referencing the May 2026 Critical Patch Update Security Alert.
Organizations running Oracle E-Business Suite are strongly urged to consult this advisory immediately to determine patch applicability for their deployed version.
Mitigation
Security teams managing Oracle EBS deployments should take the following steps:
- Apply Oracle’s May 2026 Critical Patch Update without delay, prioritizing internet-facing instances.
- Cross-reference exposure data via Shadowserver’s dashboard or direct constituency reporting to identify at-risk assets.
- Restrict internet-facing access to EBS instances where feasible, using VPNs or IP allowlisting as compensating controls.
Given the active exploitation status and the sensitive nature of data typically housed within ERP systems, organizations should treat this disclosure as time-critical and prioritize patching over routine maintenance cycles.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 instances worldwide, following an upgrade to its fingerprinting methodology.){kind=link}