Attackers probe newly patched critical Oracle EBS flaw
Original title: Hackers Start Probing Fresh Oracle EBS Vulnerability
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
Defused says threat actors began probing CVE-2026-101767, a critical SQL injection in Oracle E-Business Suite’s Application Object Library, patched in Oracle’s October CPU. The unauthenticated HTTP flaw, scored CVSS 9.8 and reported by Horizon3.ai, can lead to remote code execution and full takeover of that component. Defused’s EBS decoys recorded exploratory exploits on October 27. SecurityWeek notes no other reports of in-the-wild exploitation.
Unconfirmed: Only Defused reports October 27 decoy probes; the article says there are no other in-the-wild exploitation reports.
- The bug is an unauthenticated SQL injection reachable over HTTP.
- Successful exploitation could completely take over the Application Object Library.
- Defused previously warned in June about attacks on CVE-2026-46817 in EBS Payments.
- Last year Cl0p used earlier EBS zero-days in a campaign affecting potentially over 100 organizations.
Impact: Unauthenticated remote code execution and full component takeover
| Product | Affected | Fixed in |
|---|---|---|
| Oracle E-Business Suite Application Object Library | — | October CPU |
- 1.Apply Oracle’s October CPU that patches CVE-2026-101767.
- CVEs
- CVE-2026-101767
- Vendors
- Oracle
- Products
- E-Business Suite
- Organizations
- DefusedHorizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×4 |
From the original article
1 min read at securityweek.com
CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.