Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Original title: Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
Defused Cyber reports that threat actors are probing internet-facing Oracle E-Business Suite deployments for CVE-2026-101767, a critical unauthenticated SQL injection flaw in the Thin Client Framework servlet that chains to remote code execution. Oracle patched the flaw, found by Horizon0.ai researchers on July 24, in last week's Critical Patch Update. Successful exploitation lets an attacker execute SQL as the APPS database user and run OS commands as the EBS application account, exposing financial, payroll, HR and procurement data.
Unconfirmed: Defused Cyber describes the activity as exploratory probing of decoys, not confirmed breaches of real deployments.
- CVE-2026-101767 carries a CVSS score of 9.8.
- Horizon0.ai reported the flaw to Oracle on July 24, 2026.
- Attackers target the vulnerable servlet at /OA_HTML/AppsTCFServer.
- Two prior critical EBS flaws were actively exploited over the past year, one by Cl0p.
- Internal EBS systems are also at risk if the servlet is reachable.
Impact: unauthenticated SQL injection chaining to OS command execution as the EBS application account
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite Oracle Application Object Library | — | October 2026 Critical Patch Update |
- 1.Apply the latest Oracle Critical Patch Update
- 2.Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist if patching is delayed
- 3.Monitor for unauthenticated POSTs to /OA_HTML/AppsTCFServer and SQL reconnaissance from the EBS host
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Products
- Oracle E-Business Suite
- Threat actors
- Cl0p
- Organizations
- Defused CyberHorizon0.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | horizon3.ai | EBS application host and database for signs of compromise. Horizon3.ai has also shared the below indicators of compromise - Unauth |
From the original article
2 min read at thehackernews.com
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9. 8) in the Oracle Application Object Library of Oracle E-Business Suite.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.