Oracle E-Business Suite 159 vulnerabilities patched
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Oracle patches 159 E-Business Suite flaws including three critical remote code execution issues requiring no authentication.
Oracle has released security updates addressing 159 vulnerabilities across multiple E-Business Suite products and modules. Three vulnerabilities have been designated critical with CVSS scores of 9.8: CVE-2026-83327 in Oracle Applications Framework, CVE-2026-83452 in Oracle Document Management and Collaboration, and CVE-2026-83462 in Oracle Mobile Application Server. These critical flaws can be exploited remotely without authentication, require low attack complexity, and involve no user interaction. Successful exploitation grants complete control of affected components with high impact to confidentiality, integrity, and availability.
Of the total 159 vulnerabilities, 19 can be exploited remotely without authentication. The remaining issues may require user interaction, low privilege levels, or prior access. Vulnerability impacts range from unauthorized access to sensitive information, data modification or deletion, full system compromise, and denial of service. CVSS scores span from 5.4 to 9.8. The affected products include Oracle Applications Framework, Oracle Document Management and Collaboration, Oracle Mobile Application Server, Oracle Alert, Oracle Contracts, Oracle HRMS, Oracle Financials modules, Oracle CRM components, Oracle Sales, and numerous other E-Business Suite applications. The NCSC-NL advises prioritizing patching of the three critical vulnerabilities and deploying available updates across all affected components.
Mentioned in this report
Detection guidance
Oracle E-Business Suite Application Tier Java Process Spawning Shell or Download Tool
Detects the Java managed server of an Oracle EBS WebLogic application tier (oacore, oafm, forms) spawning a shell or download utility, a typical post-exploitation pattern after unauthenticated remote exploitation of the web tier. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Oracle E-Business Suite Application Tier Java Process Spawning Shell or Download
Tool
id: 5d42b889-5c14-599f-8bb2-187b02d36d9c
status: experimental
description: Detects the Java managed server of an Oracle E-Business Suite WebLogic
application tier (oacore, oafm, forms) spawning an interactive shell or download/network
utility. This is a common post-exploitation pattern after remote unauthenticated
exploitation of a public-facing EBS component (for example Applications Framework,
Document Management and Collaboration, or Mobile Application Server). Matches the
parent/child relation, not any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith: /java
ParentCommandLine|contains:
- oacore_server
- oafm_server
- forms_server
- Dweblogic.Name=oacore
- Dweblogic.Name=oafm
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /ncat
- /python
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- Oracle EBS patching or AutoConfig scripts launched from the managed server JVM
- Custom concurrent program or integration wrappers that legitimately shell out from
the application tier
level: medium
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0376.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0376.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs