Exploratory probes hit patched Oracle EBS RCE CVE-2026-101767
Original title: Hackers Actively Exploiting New Oracle EBS RCE Vulnerability
Defused saw unauthenticated SQL-injection attempts against EBS decoys on October 27; customer breaches are not confirmed.
Defused reported exploratory exploit attempts on October 27, 2026, against Oracle E-Business Suite decoys for CVE-2026-101767, a critical unauthenticated flaw scored 9.8. Horizon3.ai reported the issue on July 24, and Oracle patched it on October 20 in the October Critical Patch Update. A crafted request to the Thin Client Framework servlet can inject SQL as the APPS user and then run OS commands as the EBS application account. The activity does not confirm successful attacks, stolen data, or a widespread campaign.
Unconfirmed: Decoy probes do not confirm successful exploitation of customer systems or data theft.
- Affected versions are Oracle EBS 12.2.3 through 12.2.15.
- The servlet path is /OA_HTML/AppsTCFServer and needs no credentials.
- Commands run as the application account, not full host admin by default.
- Until patched, Horizon3.ai advises blocking the servlet and limiting web access.
- Defenders should review unauthenticated POSTs invoking GanttDataServer.
Impact: Unauthenticated SQL injection chaining to OS command execution
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite | 12.2.3 through 12.2.15 | October 20 Critical Patch Update |
- 1.Apply Oracle's October Critical Patch Update.
- 2.Remove the TCF servlet from the EBS URL firewall allowlist and restrict web access to trusted networks.
- 3.Review unauthenticated POST requests invoking GanttDataServer and unexpected files in $APPLPTMP.
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Products
- Oracle E-Business Suite
- Organizations
- DefusedHorizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 |
From the original article
2 min read at cybersecuritynews.com
Hackers have begun testing a critical Oracle E-Business Suite vulnerability that can let them run commands without logging in. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026. However, these observations do not confirm successful attacks against customer systems, and Oracle had already released a patch before the […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.