Unauthenticated attackers exploit critical vulnerabilities for remote code execution in Oracle E-Business Suite

Summary

Security researchers have identified ongoing attacks targeting Oracle E-Business Suite (EBS) and Oracle PeopleSoft infrastructure. In the case of EBS, threat actors are exploiting a flaw in the File Transmission component of the Oracle Payments product. Simultaneously, an extortion campaign attributed to UNC6240 (ShinyHunters) has been targeting PeopleSoft environments, specifically focusing on the higher education sector.

While some vulnerabilities were initially used as zero-days before vendor patches were available, both issues now have official security updates from Oracle. Security monitoring indicates that hundreds of EBS instances remain exposed online, presenting a significant attack surface for unauthenticated actors.

What happened

Threat intelligence firm Defused reported observing active exploitation of an Oracle E-Business Suite vulnerability over a recent weekend. This activity was detected on company honeypots, marking the first known instance of this specific flaw being used in the wild. Internet security watchdog Shadowserver has also identified approximately 950 Oracle EBS instances exposed to the internet, though it is currently unknown how many of these remain unpatched.

Parallel to the EBS activity, a campaign targeting Oracle PeopleSoft was identified by Mandiant and Google Threat Intelligence Group (GTIG). This campaign, attributed to UNC6240 (ShinyHunters), operated between May 27 and June 9, 2026. The attackers targeted Environment Management Hub (PSEMHUB) endpoints to facilitate remote code execution. This activity resulted in the theft of organizational data, which was subsequently published on the ShinyHers Data Leak Site (DLS).

Technical details

The exploitation of Oracle E-Business Suite involves a flaw in the File Transmission component of the Oracle Payments product. The vulnerability allows an unauthenticated attacker with HTTP network access to take over vulnerable systems through low-complexity attacks.

In the PeopleSoft campaign, attackers utilized a MeshCentral remote management server to establish command and control (C2) infrastructure. They deployed customized Windows agents designed to mimic legitimate Microsoft Azure services, specifically using names such as meshagent32-azure-ops.exe and meshagent64-azure-ops.exe. These agents were hardcoded to communicate with the C2 domain wss://azurenetfiles.net:443/agent.ashx.

Once inside the network, attackers performed targeted reconnaissance by inspecting specific configuration files to map the environment:

• Checking the process scheduler via psappsrv.cfg to extract machine names and IP addresses.
• Auditing network configurations and active mounts using mount | grep -E "psoft|ps_config|nfs".
• Inspecting WebLogic server XML configurations (config.xml) to map internal application servers.

To propagate through the network, attackers used a custom script named [victim_abbreviation]_fanout.sh and executed it via the MeshCentral command-line utility meshctrl.js.

Affected products and fixed versions

The following Oracle products are subject to active exploitation or recent zero-day activity:

Detection opportunities

Security teams can look for indicators of the PeopleSoft/ShinyHunters campaign by monitoring for specific administrative actions and file patterns:

• File Patterns: Look for the presence of [victim_abbreviation]_fanout.sh in /tmp directories or files named README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.
• Process/Command Activity: Monitor for the use of meshctrl.js to execute remote commands and the execution of grep commands targeting psappsrv.cfg.
• Network Indicators: Watch for outbound connections to the domain azurenetfiles.net or unauthorized SSH connections to known DLS mirror IPs such as 176.120.22.24.

Defender guidance

Immediate action is required for all organizations running Oracle E-Business Suite and PeopleSoft.

1. Apply Security Updates: Prioritize the installation of the May 2026 Critical Security Patch Update for Oracle EBS to address CVE-2026-46817. For PeopleSoft, ensure all patches related to the Environment Management component are applied.
2. Restrict Network Exposure: Audit all internet-facing Oracle instances. Minimize the exposure of File Transmission and Environment Management Hub endpoints to the public web.
3. Verify Configuration Integrity: Inspect psappsrv.cfg and WebLogic config.xml files for unauthorized modifications or entries that could indicate reconnaissance activity.
4. Monitor Remote Management Tools: Audit the use of MeshCentral or similar remote management software within your environment to ensure no unauthorized agents have been deployed.