1950s pulp illustration of a riveted ledger machine and robot under a probing beam through a breached portal, for an Oracle E-Business Suite vulnerability alert

Oracle EBS CVE-2026-101767: probes hit SQLi-to-RCE

Home » Alert » Oracle EBS CVE-2026-101767: probes hit SQLi-to-RCE

ALERT · Exploitation attempts observed. Last updated 28 October 2026. See the Alert Tracker

Defused’s Oracle E-Business Suite decoys recorded exploratory exploit attempts against CVE-2026-101767 on 27 October, a week after Oracle’s October Critical Patch Update. The flaw is an unauthenticated SQL injection in Application Object Library that can chain to remote code execution. It is not in CISA’s Known Exploited Vulnerabilities catalogue as of 28 October.

What happened

Defused (opens in a new tab) posted that its EBS decoys saw exploratory exploits against CVE-2026-101767 on the morning of 27 October. Oracle rates the issue Critical (CVSS 3.1 9.8) in the October 2026 Critical Patch Update (opens in a new tab): an easily exploitable SQL injection in the Oracle Application Object Library Core component that lets an unauthenticated attacker with HTTP access take over Application Object Library. Horizon3.ai (opens in a new tab), which found and reported the bug, says the vulnerable Thin Client Framework servlet at /OA_HTML/AppsTCFServer is allowed through the default EBS URL firewall, that SQL runs as the APPS database user, and that the chain can reach operating-system commands as the EBS application account.

Who is affected

Oracle lists Application Object Library in E-Business Suite versions 12.2.3 through 12.2.15. Internet-facing EBS web tiers are the clearest exposure; Horizon3 notes internal deployments are also at risk if an attacker can reach the servlet. EBS has a recent history of mass targeting: Defused flagged attacks on CVE-2026-46817 in June (Oracle patched it in the May 2026 CSPU (opens in a new tab); CISA later listed it in KEV), and last year’s Cl0p EBS campaign potentially affected more than 100 organisations across many sectors, as summarised by SecurityWeek (opens in a new tab).

What to do now

  • Apply the October 2026 CPU for EBS 12.2.3–12.2.15 using Oracle’s E-Business Suite patch availability documentation (My Oracle Support Note KA923, per Horizon3).
  • Until patched: remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict web-tier access to trusted networks.
  • Hunt: unauthenticated POSTs to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer; SQL reconnaissance soon after; unexpected files in $APPLPTMP; and the oracle account spawning /bin/sh via Concurrent Manager (Horizon3 indicators).

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)