Oracle E-Business Suite Under Fire: Analysis & Defense for May 2026 CSPU

---
title: Potential Oracle EBS RCE via FNDLIBR Shell Spawn
id: 8a1b2c3d-4e5f-6789-0abc-1def23456789
status: experimental
description: Detects potential Remote Code Execution against Oracle E-Business Suite by identifying the FNDLIBR (Concurrent Manager) process spawning shell commands. This behavior is abnormal for standard EBS operations.
references:
  - https://www.oracle.com/security-alerts/
author: Security Arsenal
date: 2026/05/28
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\FNDLIBR.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: Oracle EBS WebLogic Java Suspicious Child Process
id: 9b2c3d4e-5f6a-7890-1bcd-2efg34567890
status: experimental
description: Detects suspicious process spawning from Oracle WebLogic or Java processes commonly associated with Oracle E-Business Suite, indicative of deserialization or RCE exploitation.
references:
  - https://www.oracle.com/security-alerts/
author: Security Arsenal
date: 2026/05/28
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentProcessName|contains:
      - 'java'
      - 'weblogic'
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/usr/bin/curl'
      - '/usr/bin/wget'
  filter_main:
    CommandLine|contains: 'Oracle'
  condition: selection and not filter_main
falsepositives:
  - Legitimate system administration by the oracle user
level: high

// Hunt for Oracle EBS (FNDLIBR) spawning shells on Windows endpoints
DeviceProcessEvents
| where InitiatingProcessFileName =~ "FNDLIBR.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

// Hunt for Java/WebLogic processes spawning shells on Linux (via Syslog/CEF)
Syslog
| where ProcessName contains "java"
| where ProcessName contains "weblogic" or SyslogMessage contains "E-Business"
| extend ShellSpawned = extract(@'(\/(bin\/sh|bin\/bash))', 1, SyslogMessage)
| where isnotempty(ShellSpawned)
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for FNDLIBR or WebLogic Java processes with unusual child processes
SELECT Pid, Ppid, Name, Exe, Username, CommandLine
FROM pslist()
WHERE Name =~ "FNDLIBR"
   OR Name =~ "java"

-- Cross-reference with network connections established by these processes
SELECT P.Pid, P.Name, P.Username, C.RemoteAddress, C.RemotePort
FROM pslist() P
LEFT JOIN netstat() C ON P.Pid = C.Pid
WHERE P.Name =~ "FNDLIBR" 
   OR (P.Name =~ "java" AND P.CommandLine =~ "weblogic")

#!/bin/bash
# Oracle EBS May 2026 CSPU Remediator
# Run as 'oracle' user or root with appropriate environment variables sourced

EBS_BASE="/u01/install/APPS"\echo "[+] Checking for Oracle E-Business Suite environment..."

if [ -z "$EBS_BASE" ]; then
    echo "[-] EBS_BASE not set. Please update script or source environment."
    exit 1
fi

# Check OPatch utility availability
OPATCH_LOC="$EBS_BASE/tech_st/10.1.2/OPatch/opatch"
if [ -f "$OPATCH_LOC" ]; then
    echo "[+] OPatch found at $OPATCH_LOC"
    echo "[!] Recommended Action: Review the May 2026 CSPU advisory for specific EBS Patch IDs."
    echo "[!] Command to apply patch: $OPATCH_LOC apply -silent <PATCH_ID>"
else
    echo "[-] OPatch not found in standard location. Please verify installation path."
fi

# Check for the Critical Patch Date in the inventory (Generic check logic)
echo "[+] Listing recently applied patches for verification..."
$OPATCH_LOC lsinventory | tail -20

echo "[+] REMEDIATION STEPS:"
echo "1. Download May 2026 CSPU patches from Oracle Support."
echo "2. Apply the 12 EBS patches immediately."
echo "3. Restart Oracle Application Tier services (adstpall.sh / adstrtal.sh)."