Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Original title: Hackers now scanning systems for recently-patched Oracle flaw
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
Attackers are probing the internet for Oracle E-Business Suite systems missing the fix for CVE-2026-101767, an unauthenticated SQL injection in the Thin Client Framework that can chain to remote code execution. Oracle patched it in the October 20, 2026 Critical Patch Update. Defused said its decoys recorded exploratory exploits on October 27. Shadowserver tracks over 670 internet-exposed EBS instances, mostly on US addresses, without saying how many are patched or honeypots.
Unconfirmed: Confirmed exploitation is limited to Defused decoys; Oracle has not classified CVE-2026-101767 as exploited, and Shadowserver does not say how many hosts are still vulnerable.
- The bug is in the Application Object Library and needs only HTTP access.
- Oracle urged customers on supported versions to apply patches without delay.
- Shadowserver counts over 670 exposed Oracle EBS instances.
- Oracle has not tagged CVE-2026-101767 as exploited in the wild.
Impact: Unauthenticated remote code execution on vulnerable EBS systems
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite | — | October 2026 Critical Patch Update |
- 1.Apply Oracle’s October 2026 Critical Patch Update for E-Business Suite.
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Products
- Oracle E-Business Suite
- Organizations
- DefusedShadowserver
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 |
From the original article
2 min read at bleepingcomputer.com
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.