Oracle EBS CVE-2026-101767: Probing Started a Week After the Patch

If you run Oracle E-Business Suite, this is the one to move up your list. CVE-2026-101767 is an unauthenticated SQL injection that chains to remote code execution, CVSS 9.8. Oracle fixed it in the October Critical Patch Update on October 20. On October 27, Defused Cyber saw the first exploit attempts against its EBS decoys.

What the Bug Does

Horizon3.ai found it and reported it to Oracle on July 24. Per their write-up:

• Affected: EBS 12.2.3 through 12.2.15.
• Where: the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. And here's the bad part: the default EBS URL firewall allows it.
• Chain: one crafted, unauthenticated request runs SQL as the APPS database user, which leads to OS commands as the EBS application account.

EBS holds payroll, HR, purchasing, and financial records. That's the whole company in one database.

What's Confirmed and What Isn't

Let's be precise. Defused saw exploratory attempts against decoys. That's not a confirmed compromise of a real customer, and there's no public attribution. As of today, it's also not on CISA's KEV list.

But I wouldn't wait for those boxes to get checked. Two earlier critical EBS flaws, CVE-2025-61882 and CVE-2026-46817, were exploited in the wild, and Cl0p used the first one in its extortion campaign. EBS is a known, proven target, and the playbook is well rehearsed.

Credit Where It's Due

Horizon3 disclosed responsibly, gave Oracle three months, and published clear indicators of compromise along with the fix. That's what lets defenders hunt instead of guess.

What To Do

• Patch with the October 2026 CPU. That's the fix. Everything else is a stopgap.
• If you can't patch today, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
• Get EBS off the internet. There's almost no good reason for an ERP's web tier to be reachable by the whole world. Put it behind private, identity-based access so only authenticated users ever see it. You can't exploit a servlet you can't reach.
• Hunt, using Horizon3's indicators: unauthenticated POSTs to the servlet that instantiate GanttDataServer followed by database activity, SQL reconnaissance right after unauthenticated requests, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through Concurrent Manager.
• Don't forget internal exposure. Horizon3 and The Hacker News both note the servlet is exploitable from inside too, if an attacker can reach it.

Bottom Line

One week from patch to probing is the new normal. EBS has been an extortion target before, and the attackers remember. Patch it, hide it, and hunt for anyone who got there first.

Sources: Horizon3.ai on CVE-2026-101767, The Hacker News, and Cyber Security News