Oracle E-Business Suite flaw faces probing days after patch

Threat actors have begun probing CVE-2026-101767, a critical Oracle E-Business Suite vulnerability with a CVSS score of 9.8, days after Oracle issued a fix in its latest Critical Patch Update. Defused Cyber said its Oracle E-Business Suite decoys recorded exploratory exploit attempts on October 27.

The issue is in the Oracle Application Object Library and was reported to Oracle on July 24, 2026, by Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King. Oracle patched the vulnerability last week, but the observed activity shows that defenders should treat the update as urgent.

Unauthenticated SQL injection can lead to code execution

Horizon3.ai describes CVE-2026-101767 as an unauthenticated SQL injection vulnerability in EBS's Thin Client Framework servlet. An attacker with network access to the affected service can send a crafted request to /OA_HTML/AppsTCFServer.

The request can execute SQL with the privileges of the APPS database user. The attack chain can then enable operating system command execution under the EBS application account, creating a path from a web-facing servlet to the application host.

A successful attack may allow an intruder to read or modify application data available to APPS and run commands on the server. Horizon3.ai warned that, depending on the deployment, exposed information may include financial, payroll, human-resources and procurement records. The scope of operating system access depends on the permissions assigned to the compromised EBS application account.

External exposure is the most immediate concern

Internet-facing EBS deployments carry the greatest risk because they can make the vulnerable servlet directly reachable. Internal installations are not exempt: exploitation remains possible when an attacker reaches the servlet from a compromised system or an accessible network segment.

Defused Cyber's observation is significant because it indicates that activity has started shortly after the patch became available. Oracle E-Business Suite has also been a recurring target. Two other critical EBS flaws, CVE-2025-61882 and CVE-2026-46817, both rated 9.8, were actively exploited over the past year; the former was used by the Cl0p ransomware and extortion group.

Actions for EBS administrators

Organizations should apply Oracle's latest update as soon as possible. Where patching cannot happen immediately, Horizon3.ai recommends removing /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist and restricting access to the EBS web tier to trusted networks.

Security teams should also monitor the EBS application host and database. Relevant indicators include unauthenticated POST requests to the servlet that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity; SQL reconnaissance after unauthenticated web requests; unexpected files in $APPLPTMP; and the oracle account spawning /bin/sh through Concurrent Manager. The practical business priority is to identify reachable EBS instances, patch them, and use these indicators to investigate systems that could have been exposed before remediation.