Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.
“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused posted on X, noting that no public report of the flaw being attempted in the wild had existed before.
About CVE-2026-101767
The flaw carries a CVSS score of 9.8 and affects the Application Object Library product in EBS versions 12.2.3 to 12.2.15. Oracle’s description in the NVD entry calls it an “easily exploitable vulnerability” open to an unauthenticated attacker over HTTP.
Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the vulnerability and reported it to Oracle on July 24. The company says an attacker who can reach the vulnerable servlet over the network can run SQL as the APPS database user.
“Successful exploitation allows an attacker to read or modify application data accessible to APPS and execute commands on the application host. Depending on the deployment, affected data may include financial, payroll, HR, and procurement records,” Horizon3.ai explained.
The fix arrived with Oracle’s October 2026 patch release, published on October 20. “In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay,” the company warned.
Exposure and next steps
In its October 28 advisory, Censys reported 2,246 web properties running EBS, though its scan data can’t show which of them run an affected release or have installed the October update. Each hostname and port counts separately, so the number of individual hosts is lower.
“An Internet-facing instance that was unpatched should be reviewed for the indicators of compromise,” Censys advised.
Until patches are in place, Horizon3.ai also advises removing the /OA_HTML/AppsTCFServer servlet from the EBS URL firewall allowlist and restricting the web tier to trusted networks, and has published indicators of compromise that admins can check against.
EBS has drawn steady attention from attackers. Cl0p exploited CVE-2025-61882 as a zero-day in 2025 to steal data from organizations running the suite, and in June, Defused spotted attempts to exploit CVE-2026-46817, a flaw in the suite’s Oracle Payments module.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
