CuraSec

tag: Oracle-Ebs · 4 items

Act Oracle EBS CVE-2026-101767 (CVSS 9.8 RCE) Actively Probed Post-Patch
2026-10-28 · The Hacker News · source ↗ #oracle-ebs#rce#active-exploitation
  • Engineer — Act: Public PoC on GitHub combined with confirmed active probing makes this Act despite low EPSS; apply Oracle’s Critical Patch Update to Oracle E-Business Suite immediately and verify no external exposure of EBS endpoints.
  • SOC/IR — Act: Threat actors are already scanning for this RCE; hunt for exploitation attempts against Oracle EBS Application Object Library endpoints dating back to last week’s patch release, and tune WAF/IDS rules for CVE-2026-101767 probe patterns.
  • Leader — Plan: Oracle EBS hosts sensitive financial and HR data — confirm whether the organization runs EBS, verify the Critical Patch Update is applied this sprint, and track escalation to Act if CISA KEV listing or confirmed exploitation follows.
  • Signals: CVE-2026-101767 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
Act Attackers actively scanning for unpatched Oracle EBS RCE flaw
2026-10-28 · BleepingComputer · source ↗ #oracle-ebs#rce#active-scanning
  • Engineer — Act: Active internet-wide scanning signals exploitation is imminent; if you run Oracle E-Business Suite, apply the October critical patch update now and confirm no public-facing EBS endpoints remain exposed until patching is complete.
  • SOC/IR — Act: Scanning campaigns targeting Oracle EBS create detectable noise — hunt for exploitation attempts against EBS endpoints in web and firewall logs since the patch disclosure date, and tune rules for Oracle EBS attack patterns if EBS is in your estate.
  • Leader — Plan: Confirm with engineering whether Oracle E-Business Suite is in use and verify its patch status this week; active attacker scanning compresses the remediation window significantly and may warrant expedited change control approval.
Act archived Estée Lauder breach tied to Oracle E-Business Suite flaw
2026-07-21 · BleepingComputer · source ↗ #oracle-ebs#data-breach#erp
  • Engineer — Plan: If your org runs Oracle E-Business Suite (especially for HR), review Oracle’s recent security advisories for EBS patches and audit privileged access to HR data — no specific CVE or PoC is published yet, so active exploitation pressure is unclear.
  • SOC/IR — Learn: High-profile ERP-targeting breach with no published IOCs, TTPs, or attacker attribution to act on; file for context that Oracle EBS HR modules are being targeted, but there’s no detection work to do today.
  • Leader — Act: If your organization uses Oracle E-Business Suite, direct your team this week to confirm patch status and assess whether employee or customer PII is exposed via the same flaw; this breach will prompt customer and board questions if you operate in consumer goods or retail.
Act archived CISA KEV: Oracle E-Business Suite actively exploited, patch by Saturday
2026-07-16 · BleepingComputer · source ↗ #oracle-ebs#cisa-kev#active-exploitation
  • Engineer — Act: CISA KEV listing with confirmed active exploitation and an imminent Saturday deadline; audit your environment for Oracle E-Business Suite deployments and apply Oracle’s patch immediately.
  • SOC/IR — Act: Active exploitation is underway against Oracle EBS financial systems; initiate a hunt for anomalous EBS access patterns and monitor threat intel feeds for IOCs to sweep across relevant log sources.
  • Leader — Act: A CISA-mandated Saturday deadline on actively exploited financial software warrants same-week confirmation from your engineering team that Oracle E-Business Suite is either patched or absent from your environment.