Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Original title: Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
Defused said its Oracle E-Business Suite decoys recorded exploratory exploits on October 27 against CVE-2026-101767, an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution. Horizon3.ai, which reported the bug to Oracle on July 24, says a reachable attacker can run SQL as the APPS user and execute commands on the application host. Oracle fixed it in the October 20, 2026 patch release and urged customers to patch supported versions. Censys counted 2,246 EBS web properties but cannot tell which are vulnerable or patched.
Unconfirmed: Observed activity was on Defused decoys; the report does not confirm successful compromise of customer EBS systems for this CVE.
- CVSS score is 9.8; affected releases are EBS 12.2.3 through 12.2.15.
- Exposed data can include financial, payroll, HR, and procurement records.
- Censys’s 2,246 count treats each hostname and port separately, so hosts are fewer.
- Until patching, Horizon3.ai advises blocking /OA_HTML/AppsTCFServer and limiting the web tier to trusted networks.
Impact: Unauthenticated SQL access as APPS and host command execution
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite Application Object Library | 12.2.3 to 12.2.15 | October 2026 patch release |
- 1.Apply Oracle’s October 20, 2026 security patches on supported EBS versions.
- 2.Remove /OA_HTML/AppsTCFServer from the URL firewall allowlist and restrict the web tier to trusted networks.
- 3.Review unpatched internet-facing instances against published indicators of compromise.
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Products
- Oracle E-Business Suite
- Organizations
- Horizon3.aiCensysDefused
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | horizon3.ai | lnerability” open to an unauthenticated attacker over HTTP. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King fou |
From the original article
2 min read at helpnetsecurity.com
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.