Oracle EBS Flaw CVE-2026-101767 Draws First Probes

Attackers have begun probing a critical flaw in Oracle E-Business Suite a week after Oracle released a fix, according to threat intelligence firm Defused. In a post on X on 27 October, the company said its “Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767” that morning.

The flaw is an unauthenticated SQL injection that can be chained to remote code execution. Oracle rates it 9.8 out of 10 and patched it in its October Critical Patch Update on 20 October. Defused’s report is of attempts against its own decoy systems. No company has said it was breached through this flaw, and SecurityWeek reported that there have been no other reports of its exploitation in the wild. For anyone running E-Business Suite, the message from both Oracle and the researchers who found the bug is the same: patch now.

In brief

Defused says its decoys logged exploratory exploits against CVE-2026-101767 on 27 October.
The 9.8-rated flaw lets an unauthenticated attacker run SQL and then system commands on EBS 12.2.3 to 12.2.15.
Oracle fixed it on 20 October; no breach through the flaw has been reported.

What the flaw does

Oracle’s advisory lists CVE-2026-101767 in Oracle Application Object Library, a core part of E-Business Suite, affecting versions 12.2.3 to 12.2.15. It says the flaw can be exploited remotely over HTTP without a username or password. Oracle credits Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai with reporting it.

Horizon3.ai’s own advisory gives more detail. The weak point is the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, which the firm says “is permitted through the default EBS URL firewall configuration”. A crafted request lets an attacker run SQL as the APPS database user and then run operating system commands as the EBS application account.

That is a serious level of access for a system many companies use to run their back office. Horizon3.ai says that, depending on the deployment, the data at risk “may include financial, payroll, HR, and procurement records”. Internet-facing EBS web servers face the most direct exposure, it says, but internal systems are also at risk if an attacker can reach the servlet from another compromised machine.

Horizon3.ai says it disclosed the flaw to Oracle on 24 July. The fix shipped as one of 194 new E-Business Suite patches in the October update, which TSN covered when it was released. Oracle points administrators to My Oracle Support Note KA923 for the patches that apply to their installation.

What administrators can do now

Until patches are installed, Horizon3.ai recommends three steps:

remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist
restrict access to the EBS web tier to trusted networks
monitor the application host and database for signs of compromise

It adds that these measures only reduce exposure and are no substitute for installing the fix.

The firm also lists signs of compromise to look for. These include unauthenticated POST requests to the servlet that load the oracle.apps.jtf.gantt.server.GanttDataServer class, followed by database activity, and SQL reconnaissance shortly after unauthenticated web requests. Others are unexpected files in the $APPLPTMP directory and the oracle account starting /bin/sh through the Concurrent Manager.

Decoy hits are an early warning, not a breach count

Defused’s report is a signal about attacker interest, not evidence that any real EBS system has been compromised. Decoys are built to attract scanning, and the post describes “exploratory” exploits rather than successful intrusions. A similar pattern followed the recent PHP flaw known as PHP2Shell, which Horizon3.ai also published an advisory on: honeypots logged confirmed code execution on decoys, but no victim breach was reported.

Still, the timing should worry EBS customers. The gap between Oracle’s patch and the first recorded attempts was seven days, shorter than a typical enterprise change window for a business-critical system. E-Business Suite has a track record as a target. SecurityWeek notes that Defused warned of attacks on a different EBS flaw, CVE-2026-46817 in the Payments product, in June. It also recalls that the Cl0p extortion group exploited EBS zero-days last year in a campaign that potentially affected more than 100 organisations.

Oracle’s advisory makes the broader point itself. The company says it “continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches”, and “strongly recommends that customers remain on actively-supported versions and apply security patches without delay”. A stronger signal would be an entry on the US cyber agency CISA’s Known Exploited Vulnerabilities catalogue, which this week added the Brotli decoder flaw with a 10 November fix deadline for federal agencies. CVE-2026-101767 is not on that list, and no evidence of real-world exploitation has been published.

Oracle’s next quarterly Critical Patch Update is due on 19 January 2027.