Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 days after patch

TLDR

• Defused says its decoys recorded exploratory exploits against Oracle EBS flaw CVE-2026-101767 on 27 October, days after the patch.³⁴⁵
• Oracle rates the unauthenticated flaw CVSS 9.8 and lists Application Object Library versions 12.2.3 to 12.2.15 as affected.¹
• Horizon3.ai says it chains to remote code execution; interim step is removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.²

Threat actors have started probing for CVE-2026-101767, a critical flaw in Oracle E-Business Suite (EBS) that Oracle fixed in its October 2026 Critical Patch Update, released on 20 October.²³ Threat intelligence firm Defused said its EBS decoys recorded exploratory exploits against the bug on the morning of 27 October.³⁴ BleepingComputer notes that Oracle has not yet tagged the flaw as exploited in the wild, and SecurityWeek says there have been no other reports of in-the-wild exploitation.³⁵ Oracle's advisory says attackers have in some instances succeeded because customers failed to apply available patches, and it urges customers to apply security patches without delay.¹

Oracle's risk matrix lists the vulnerability in the Oracle Application Object Library (component: Core) as exploitable over HTTP without authentication, with a CVSS 3.1 base score of 9.8 and affected supported versions 12.2.3 to 12.2.15.¹ Oracle credits Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai with the find.¹ Horizon3.ai describes an unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer that lets an attacker run SQL as the APPS database user and then run operating system commands as the EBS application account.² It says it disclosed the flaw to Oracle on 24 July, and that the endpoint is permitted through the default EBS URL firewall configuration.² The Hacker News labels the bug as improper authentication, while Defused, SecurityWeek and Horizon3.ai describe an unauthenticated SQL injection that chains to remote code execution.²⁴⁵

Horizon3.ai says affected data may include financial, payroll, HR and procurement records, and that internet-facing web tiers are the most direct exposure, although internal systems are also at risk if an attacker can reach the servlet.² Its indicators of compromise include unauthenticated POST requests to the servlet that instantiate the oracle.apps.jtf.gantt.server.GanttDataServer class followed by backend database activity, SQL reconnaissance shortly afterwards, and the oracle account spawning /bin/sh through the Concurrent Manager.²⁴ Until patches are applied, it advises removing the servlet from the URL firewall allowlist and restricting the web tier to trusted networks, measures it says reduce exposure but do not replace patching.²

BleepingComputer says Shadowserver tracks over 670 internet-exposed Oracle EBS instances, mostly with US IP addresses, but adds that Shadowserver does not indicate how many are honeypots or already patched.³ It also recalls that the Clop extortion gang has exploited another EBS flaw, CVE-2025-61882, in zero-day attacks since early August 2025, and SecurityWeek says that campaign potentially affected over 100 organisations.³⁵ The Hacker News adds that a further critical EBS flaw, CVE-2026-46817, has also been exploited over the past year.⁴

Why it matters: attackers are already probing an unauthenticated flaw that Horizon3.ai says can expose financial, payroll, HR and procurement data, and Oracle urges customers to patch without delay.¹²³