Oracle EBS Instances Probed in Broad Internet Scanning Campaign

En bref

• Attackers recently began probing Oracle EBS deployments across the public internet.
• Exposed and unpatched instances are the primary concern.
• No CVE has been associated with the observed scanning.
• Administrators should reduce exposure and verify patch levels.

Oracle E-Business Suite (EBS) deployments are being probed by attackers in a broad campaign that reaches across the public internet. The activity observed recently consists of scanning and reconnaissance rather than a confirmed exploitation tied to a specific vulnerability. No CVE has been identified in connection with these probes.

The main risk centers on EBS systems that are reachable from the internet and have not received current Oracle updates. Even without a named CVE, scanning can reveal version details, exposed services, and weak configurations that attackers may use later. Unpatched and exposed systems deserve immediate attention because they give adversaries more opportunities to learn about the environment.

For K-12 and government IT teams, this is a reminder that enterprise applications often sit outside the spotlight of endpoint security. Oracle EBS can hold sensitive finance, HR, and operational data, so internet-facing instances should be treated as high-value targets. The absence of a CVE does not mean the scanning is harmless; it means defenders should focus on exposure reduction, patch discipline, and monitoring rather than waiting for a named exploit.

What to watch: unusual connection attempts to EBS endpoints, spikes in requests from unfamiliar sources, and signs that systems are advertising outdated components. Administrators should confirm which EBS instances are publicly reachable, review recent logs for probing patterns, and close unnecessary access paths. If a system does not need direct internet exposure, remove it from public reach and require controlled access.

À faire maintenant

1. Inventory all Oracle E-Business Suite instances and identify which ones are reachable from the public internet.
2. Remove direct internet exposure where possible; require VPN, allowlisted source ranges, or a protected gateway.
3. Verify Oracle EBS patch levels and apply current vendor updates for any unpatched systems.
4. Review web server, application, and network logs for scanning or probing patterns against EBS endpoints.
5. Restrict administrative interfaces and unnecessary services to trusted networks only.
6. Confirm backups and recovery procedures for EBS systems before making exposure or patching changes.
7. Coordinate with Oracle support or trusted advisors if suspicious probing is followed by unusual access attempts.

Source originale

BleepingComputer