Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Attackers probe patched Oracle EBS flaw CVE-2026-101767

7 sources · 8 articlesFirst reported Updated ()1
What's new

October 29: Help Net Security adds Censys counted 2,246 EBS web properties, noting hosts are fewer because hostname and port are counted separately.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Honeypots logged exploratory exploits of critical unauthenticated Oracle EBS flaw CVE-2026-101767 on October 27; customer breaches remain unconfirmed.

Defused says threat actors began probing internet-facing Oracle E-Business Suite systems for CVE-2026-101767, a critical unauthenticated SQL injection in the Application Object Library's Thin Client Framework that can chain to remote code execution. Oracle patched the flaw in its October 20, 2026 Critical Patch Update. Affected versions are EBS 12.2.3 through 12.2.15, and the CVSS score is 9.8. SecurityWeek, Cyber Security News and Help Net Security attribute the report to Horizon3.ai on July 24; The Hacker News names Horizon0.ai. A request to /OA_HTML/AppsTCFServer can run SQL as the APPS user and OS commands as the EBS application account, exposing financial, payroll, HR and procurement data. Defused decoys logged exploratory exploits on October 27, but no customer breaches are confirmed, and Oracle has not marked the flaw exploited in the wild.

Key facts
  • CVE-2026-101767 is unauthenticated SQL injection scored CVSS 9.8.
  • Affected releases are Oracle EBS 12.2.3 through 12.2.15.
  • Oracle patched it in the October 20, 2026 Critical Patch Update.
  • Target servlet is /OA_HTML/AppsTCFServer; commands run as the application account.
  • Shadowserver tracks over 670 exposed EBS instances, mostly on US addresses.
  • Censys counted 2,246 EBS web properties, not distinct patched hosts.
Analyze CVE-2026-101767 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Jul 24, 2026Researchers reported the EBS flaw to Oracle. · Cyber Security News
  2. Oct 20, 2026Oracle patched CVE-2026-101767 in the October CPU. · BleepingComputer
  3. Oct 27, 2026Defused decoys logged exploratory exploit attempts. · SecurityWeek

What each outlet adds

beyond the shared facts
  • SecurityWeekSays no other in-the-wild exploitation reports are cited.
  • Cyber Security NewsNames Horizon3.ai and advises blocking the servlet until patched.
  • BleepingComputerShadowserver tracks over 670 exposed EBS instances; Oracle has not tagged exploitation.
  • The Hacker NewsNames Horizon0.ai and lists financial, payroll, HR and procurement exposure.
  • Help Net SecurityCensys counted 2,246 EBS web properties, not unique hosts.
CVEs
CVE-2026-101767CVE-2026-35273
Vendors
Oracle
Products
Oracle E-Business SuitePeopleSoftPeopleSoft Integration GatewayPeopleSoft Environment Management HubE-Business SuitePeopleSoft Enterprise PeopleToolsIntegration GatewayEnvironment Management Hub
Threat actors
Cl0pShinyHuntersUNC6240
Organizations
Defused CyberHorizon0.aiMandiantTrendAITrendAI Zero Day InitiativeHorizon3Zero Day InitiativeCISAGoogle Threat Intelligence GroupHorizon3.aiCensysDefused
Countries
United States

Coverage

oldest first · one row per article · UTC
  1. · 3d ago Zero Day Initiative BlogFirst report

    ShinyHunters mass-exploits PeopleSoft SSRF-to-RCE bug CVE-2026-35273

    A gateway request forgery can satisfy localhost trust checks and reach a file-write path to code execution.

  2. · 2d ago The Hacker News

    ShinyHunters PeopleSoft zero-day is three flaws under CVE-2026-35273

    Unauthenticated SSRF to the loopback-trusted admin hub yields code execution on PeopleTools 8.61 and 8.62.

  3. · 2d ago SecurityWeek

    Attackers probe newly patched critical Oracle EBS flaw

    Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.

  4. · 2d ago Cyber Security News

    Exploratory probes hit patched Oracle EBS RCE CVE-2026-101767

    Defused saw unauthenticated SQL-injection attempts against EBS decoys on October 27; customer breaches are not confirmed.

  5. · 2d ago BleepingComputer

    Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767

    Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.

  6. · 2d ago The Hacker News

    Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767

    Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.

  7. · 2d ago The Register · Security

    Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws

    ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.

  8. · 1d ago Help Net Security

    Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767

    Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-101767
Missing authentication in Oracle E-Business Suite Application Object Library
9.8<1%PoC ×4
CVE-2026-35273
Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
9.897%KEVRansomwarePoC
KEV