Exploitation attempts hit patched Oracle EBS flaw CVE-2026-101767
Unauthenticated SQL injection in EBS 12.2.3–12.2.15 can run commands as APPS; the fix shipped on October 20.
1
Stories per day · 30 days
2 RSS
Relatedoracle10critical-patch-update6sql-injection6remote-code-execution3fusion-middleware2access-manager1apex1defused1honeypot1horizon01java1java-se1jd-edwards1openssl1peoplesoft1rce1shinyhunters1soa-suite1
15 stories, newest first · one card per story
Stories tagged #e-business-suite
Attackers probe patched Oracle EBS bug; PeopleSoft zero-day is three flaws
ShinyHunters used CVE-2026-35273 for theft and extortion; ZDI says Oracle bundled three PeopleSoft bugs under one CVE.
2
Attackers probe Oracle E-Business Suite SQL injection flaw CVE-2026-101767
Decoys recorded exploratory exploits on October 27 against the unauthenticated TCF servlet flaw, which chains SQL injection to command execution as the EBS application account.
2
Attackers scan for patched Oracle E-Business Suite flaw CVE-2026-101767
Defused saw exploratory SQL-injection exploits on decoys on October 27; Oracle has not marked the bug exploited.
1
Attackers probe newly patched critical Oracle EBS flaw
Defused honeypots logged exploratory exploits of CVE-2026-101767 on October 27; no other in-the-wild reports are cited.
1
Oracle October update patches 1,295 flaws, six rated CVSS 10.0
Unauthenticated network bugs can take over E-Business Suite Workflow, SOA Suite, Access Manager, and JD Edwards Orchestrator.
3
Oracle October 2026 CPU patches 1,295 flaws across dozens of products
Tenable counts 1,209 unique CVEs, including 95 critical, and Oracle has not flagged them as exploited.
10
Oracle October 2026 CPU fixes unauthenticated E-Business Suite takeover bug
CVE-2026-101809 scores CVSS 10.0 in Workflow Notification Mailer 12.2.3–12.2.15; three other issues rate 9.8, with no confirmed exploitation.
8
Oracle October 2026 CPU fixes 1209 CVEs in 1295 patches
112 updates are critical; Fusion Middleware has 206 patches, 134 remotely exploitable without authentication.
3
Oracle EBS flaw CVE-2026-101767 allows unauthenticated SQLi and RCE
Application Object Library 12.2.3 through 12.2.15 is fixed in Oracle's October 20, 2026 Critical Patch Update.
4
Oracle’s September patches put Fusion Middleware back in the hot seat
Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.
6
Oracle Critical Security Patch Update, September 2026 Review
Oracle's September 2026 Critical Patch Update fixes 673 vulnerabilities, including 104 critical, with many remotely exploitable in E-Business Suite and Fusion Middleware.
1
Oracle Critical Security Update – 673 Vulnerabilities Patched Across Product Families
Oracle's September 2026 Critical Patch Update ships 673 patches across 17 product families, including 100+ critical and 240+ remotely exploitable flaws.
7
Oracle Patches 800+ Vulnerabilities in September 2026 Security Update
Oracle's September 2026 Critical Patch Update fixes 800+ vulnerabilities, including over 100 critical flaws and 240+ remotely exploitable without authentication.
2
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
2