Ensure Oracle E-Business Suite is patched against CVE-2022-21587 .
Look for unusual ZIP extractions in system logs or the presence of .jsp files in unexpected directories like /OA_HTML/ . hAX.zip
The ZIP contains files with paths like ../../../../path/to/shell.jsp to escape the intended upload folder. hAX.zip