Exploit Probes for Oracle EBS RCE Vulnerability After Patch
October 28-29 reports add servlet path details, Censys 2,246 and Shadowserver 670+ exposure counts, plus patch blocking advice.
Defused decoys logged exploratory exploits of CVE-2026-101767 on October 27; no customer breaches confirmed.
Threat actors are probing internet-facing Oracle E-Business Suite systems for CVE-2026-101767, an unauthenticated SQL injection in the Thin Client Framework servlet that can lead to remote code execution. A crafted request to /OA_HTML/AppsTCFServer allows running SQL as the APPS user and OS commands as the EBS application account. Oracle patched the flaw, scored CVSS 9.8, on October 20, 2026 in the Critical Patch Update for versions 12.2.3 through 12.2.15. Defused recorded exploratory exploits on October 27 against decoys, but no successful attacks, stolen data, or widespread exploitation are confirmed. Shadowserver tracks over 670 exposed instances and Censys notes 2,246 EBS web properties.
- CVE-2026-101767 CVSS 9.8
- Affected versions EBS 12.2.3-12.2.15
- Servlet /OA_HTML/AppsTCFServer
- Exploit attempts October 27, 2026
- Patched October 20, 2026 CPU update
- Shadowserver 670+ exposed instances
Timeline
dated events in the reporting · oldest first- Jul 24, 2026Horizon3.ai reported CVE-2026-101767 to Oracle · Horizon3.ai
- Oct 20, 2026Oracle released Critical Patch Update fixing CVE-2026-101767 · Oracle
- Oct 27, 2026Defused recorded exploratory exploits against EBS decoys · Defused
- Oct 28, 2026Multiple outlets reported probing activity for CVE-2026-101767 · SecurityWeek Cyber Security News BleepingComputer The Hacker News Help Net…
What each outlet adds
beyond the shared facts- BleepingComputerShadowserver counts over 670 exposed EBS instances
- Help Net SecurityCensys counts 2,246 EBS web properties
- Cyber Security NewsAdvice to block the servlet and limit web access
- The Hacker NewsCVSS score and mention of prior EBS zero-days
- The RegisterPeopleSoft separate issues but not central to this story
- Vendors
- Oracle
- Threat actors
- Cl0pShinyHunters
- Organizations
- Defused CyberHorizon0.aiMandiantTrendAI Zero Day InitiativeHorizon3Horizon3.aiCensysDefusedShadowserver
- Countries
- United States
Coverage
oldest first · one row per article · UTC- · 6d ago
SecurityWeekFirst report
Attackers probe newly patched critical Oracle EBS flaw
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
- · 6d ago
Cyber Security News
Exploratory probes hit patched Oracle EBS RCE CVE-2026-101767
Defused saw unauthenticated SQL-injection attempts against EBS decoys on October 27; customer breaches are not confirmed.
- · 6d ago
BleepingComputer
Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
- · 6d ago
The Hacker News
Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
- · 6d ago
The Register · Security
Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
- · 5d ago
Help Net Security
Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-101767 | Missing authentication in Oracle E-Business Suite Application Object Library | 9.8 | <1% | PoC ×5 | |
| CVE-2026-35273 | Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools | 9.8 | 97% | KEVRansomwarePoC | KEV |