Oracle EBS flaw CVE-2026-101767 allows unauthenticated SQLi and RCE
Original title: CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
Application Object Library 12.2.3 through 12.2.15 is fixed in Oracle's October 20, 2026 Critical Patch Update.
Horizon3.ai says CVE-2026-101767 is an unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet that can be chained to operating-system commands. An attacker who can reach /OA_HTML/AppsTCFServer over HTTP or HTTPS can run SQL as the APPS user and commands as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update released October 20, covering versions 12.2.3 through 12.2.15. The CVSS 3.1 score is 9.8.
Unconfirmed: The write-up does not say whether attackers have exploited CVE-2026-101767.
- Horizon3 disclosed the zero-day privately to Oracle on July 24, 2026.
- The vulnerable servlet is permitted by the default EBS URL firewall.
- Exposed data may include financial, payroll, HR, and procurement records.
- Unexpected /bin/sh spawned by Concurrent Manager is listed as an indicator.
Impact: SQL as APPS and OS commands as the EBS account
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite Application Object Library | 12.2.3 through 12.2.15 | October 2026 Critical Patch Update |
- 1.Apply the Oracle October 2026 Critical Patch Update for the installation.
- 2.Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist until patched.
- 3.Restrict the EBS web tier to trusted networks and monitor for compromise.
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Organizations
- Horizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | — |
From the original article
3 min read at horizon3.ai
CVE-2026-101767 is a critical (CVSS 9. 8) unauthenticated SQL injection vulnerability in Oracle E-Business Suite 12. 2.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.