In a statement, the Geneva-based International Federation of Red Cross and Red Crescent Societies (IFRC) said it was "outraged", and said it would "ensure any staff involved are held to account."
The Ebola virus killed more than 11,300 people and infected an estimated 29,000, mainly in Guinea, Sierra Leone and Liberia.
The IFRC said the operations set up to contain the outbreak "were among the most complex in recent humanitarian history," with several groups moving quickly to deploy staff and mobilise volunteers, and spending tens of millions of dollars on medical equipment and other supplies.
In Sierra Leone, it said it had found evidence of "likely collusion" between former IFRC employees and a bank, leading to a potential loss of $2.1 million. Overbilling and fake invoices by a provider of customs clearance services in Guinea cost the organisation $1.2 million, and two other investigations in the country are under way.
The IFRC also said it had previously found that in Liberia, inflated prices for relief items and payroll costs had cost it $2.7 million.
The organisation said it was "committed to holding all those involved in any form of fraud to account, and to reclaiming all misappropriated, diverted, or otherwise illegally taken funds."
It also said that since 2014 it has bolstered efforts to root out corruption in its operations, including cash spending limits in "high-risk settings" and deploying trained auditors when sending out teams.