Attackers have started probing for a critical Oracle E-Business Suite vulnerability patched in Oracle’s October 2026 security update.
The vulnerability, CVE-2026-101767, affects the Oracle Application Object Library Core component in EBS versions 12.2.3 through 12.2.15. Oracle rates it CVSS 9.8 and says it can be exploited over HTTP without authentication to compromise Oracle Application Object Library. Successful attacks can result in takeover of that component.
SecurityWeek reported that threat intelligence firm Defused saw exploratory exploit attempts against its Oracle EBS decoys on Oct. 27, seven days after Oracle’s Oct. 20 Critical Patch Update. BleepingComputer published similar reporting the same day, describing the activity as internet probing for unpatched systems. Public reporting so far points to early probing and exploit attempts against decoys, not confirmed production breaches tied to this CVE.
The vulnerable path changes the risk
Oracle’s advisory identifies the affected product and impact, but not the exploit mechanism. Horizon3.ai, credited by Oracle for reporting the issue, says CVE-2026-101767 is an unauthenticated SQL injection in EBS’s Thin Client Framework servlet at /OA_HTML/AppsTCFServer. The researcher write-up says an attacker with network access to that servlet can run SQL as the APPS database user and chain the issue to operating system command execution as the EBS application account.
That chain is why this is more than a routine application bug. Depending on the deployment, Horizon3.ai says data accessible through APPS may include financial, payroll, HR and procurement records. The company also says internet-facing EBS web tiers present the most direct exposure, while internal deployments remain at risk if an attacker can reach the servlet from a compromised system or another accessible network segment.
Exposure data is useful, but limited
Censys published an Oct. 28 advisory saying it found 2,246 web properties running Oracle EBS. Censys stressed that scan data does not show whether those EBS instances are on affected releases or have applied the October update. It also noted that web property counts can include more than one hostname or port for a single host.
Oracle’s October update is broader than one CVE
Oracle’s October 2026 Critical Patch Update contains 1,295 new security patches across product families and 194 for E-Business Suite. Oracle says 31 of the EBS vulnerabilities in the update may be remotely exploitable without authentication.
In the same EBS risk matrix, Oracle lists CVE-2026-101809 as a CVSS 10.0 unauthenticated flaw in Workflow Notification Mailer, affecting the same supported EBS 12.2.3 through 12.2.15 range. Oracle also recommends applying the October update to the Oracle Database and Oracle Fusion Middleware components of E-Business Suite where applicable.
Mitigations while patching proceeds
Oracle says Critical Patch Update security patches should be applied as soon as possible and warns that blocking protocols or removing privileges may reduce risk but should not be treated as a long-term fix.
Horizon3.ai recommends applying Oracle’s October patches and, until patching is complete, removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restricting the EBS web tier to trusted networks and monitoring the EBS application host and database for signs of compromise.
Horizon3.ai’s indicators include unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, SQL reconnaissance soon after unauthenticated web requests, unexpected files in $APPLPTMP and the oracle account spawning /bin/sh through Concurrent Manager.
Check Point published an IPS protection entry for CVE-2026-101767 on Nov. 1, saying its Security Gateway protection detects attempts to exploit the vulnerability after IPS updates and policy installation.
Why this issue is being watched closely
Oracle EBS has a recent history of drawing data-theft and extortion activity. Google Threat Intelligence Group and Mandiant reported in October 2025 that a CL0P-branded extortion campaign followed months of intrusion activity targeting EBS customer environments, with exploitation likely dating back to July 2025 and possible CVE-2025-61882 activity as early as Aug. 9, 2025.
The current public record around CVE-2026-101767 is not the same: it points to early probing after a patch, not a confirmed mass compromise campaign.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
