Attackers actively scanning for unpatched Oracle EBS RCE flaw

Wed, 28 Oct 2026 17:09:30 +0000

Engineer — Act: Active internet-wide scanning signals exploitation is imminent; if you run Oracle E-Business Suite, apply the October critical patch update now and confirm no public-facing EBS endpoints remain exposed until patching is complete.
SOC/IR — Act: Scanning campaigns targeting Oracle EBS create detectable noise — hunt for exploitation attempts against EBS endpoints in web and firewall logs since the patch disclosure date, and tune rules for Oracle EBS attack patterns if EBS is in your estate.
Leader — Plan: Confirm with engineering whether Oracle E-Business Suite is in use and verify its patch status this week; active attacker scanning compresses the remediation window significantly and may warrant expedited change control approval.

Rejetto HFS servers actively scanned for RCE via weak signing key

Tue, 06 Oct 2026 17:10:43 +0000

Engineer — Act: Active scanning for CVE-2026-61500 with a public PoC means exploitation is imminent for any exposed Rejetto HFS instance; identify and patch or take offline any internet-facing HFS servers immediately.
SOC/IR — Act: Active scanning is underway — hunt for anomalous authentication or session-related traffic against HFS servers and sweep for signs of session forgery or RCE activity since the scanning began.
Leader — Skip
Signals: CVE-2026-61500 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources