Hackers Exploiting Critical Oracle EBS Vulnerability

Active exploitation June 27-28 on honeypots. Attacker IP 45.84.137.125, POST to /OA_HTML/ibytransmit with crafted XML. Patched in May 2026 CSPU addressing 35 CVEs.