Attackers have started firing exploit attempts at a critical Oracle E-Business Suite (EBS) vulnerability just 7 days after Oracle patched it. Threat intelligence firm Defused said its EBS decoy servers recorded “exploratory exploits” against CVE-2026-101767 on the morning of October 27, 2026. The flaw is an unauthenticated SQL injection that can be chained to remote code execution on the servers many large organizations use to run finance, payroll, HR and procurement.
No organization has publicly reported a breach through this flaw so far, and the activity seen to date hit honeypots rather than confirmed victims. Oracle had not issued any public statement about in-the-wild exploitation of CVE-2026-101767 at time of publication.
One crafted request to the thin client servlet
Oracle fixed CVE-2026-101767 in its October 2026 Critical Patch Update, released on October 20. The advisory lists the bug in the Core component of Oracle Application Object Library and rates it 9.8 (Critical) on CVSS 3.1. It affects supported EBS versions 12.2.3 through 12.2.15 and can be exploited over HTTP with no login and no user interaction. Oracle says a successful attack can result in takeover of the component.
Horizon3.ai, whose researchers Oracle credits with finding the flaw, published a technical advisory with more detail. The weak point is the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. According to Horizon3.ai, that endpoint is allowed through the default EBS URL firewall configuration.
A crafted request lets an attacker run SQL as the powerful APPS database user, then run operating system commands as the EBS application account. Horizon3.ai says this can expose or alter financial, payroll, HR and procurement records, depending on the deployment. The firm reported the bug to Oracle as a zero-day on July 24, 2026, about 3 months before the fix shipped.
The flaw is one of 194 new EBS patches in the October update, 31 of which Oracle says may be remotely exploitable without authentication. The same release also fixed CVE-2026-101809, a 10.0-rated bug in the Workflow Notification Mailer.
Decoys log the first probes
Defused announced the activity in a post on X at about 11:15 AM ET on October 27. The firm said its Oracle E-Business Suite decoys “recorded exploratory exploits” against the SQL injection bug that morning. It did not say how many attempts it saw or who was behind them.
Previdian, which runs its own sensor network, reports 10 exploitation attempts from 6 unique IP addresses in 6 countries between October 22 and October 28. Previdian notes that its sensor hits do not show that any target was vulnerable or that an attempt succeeded. The firm also flagged a proof-of-concept repository that appeared on GitHub on October 26, which it describes as unverified and potentially malicious.
According to reports, the Shadowserver Foundation tracks more than 670 EBS instances exposed to the internet, most of them in the United States. That count does not show how many are patched or are decoys.
Not yet on the CISA exploited list
As of October 28, 2026, CVE-2026-101767 does not appear in CISA’s Known Exploited Vulnerabilities catalog, so no federal patch deadline applies yet. CISA has added EBS flaws quickly in the past. It listed CVE-2026-46817, a separate bug in the EBS Payments product, on July 15, 2026 with a due date of July 18, just 3 days later. Defused had reported attacks on that flaw against its honeypots weeks earlier.
In its advisory, Oracle repeats a standing warning that it “continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches.” It adds that some attacks succeeded because customers “had failed to apply available Oracle patches.”
Why EBS customers remember 2025
Oracle E-Business Suite was at the center of one of the largest data theft campaigns of 2025. Google Threat Intelligence Group and Mandiant reported that a threat actor claiming affiliation with the Cl0p extortion brand exploited what may be CVE-2025-61882 as a zero-day as early as August 9, 2025. Executives at many organizations then received extortion emails starting September 29, 2025. Oracle issued an emergency Security Alert for that flaw, and CISA lists it as used in ransomware campaigns.
No researcher has linked the new probing to Cl0p or any other known group. Oracle software keeps drawing attackers, though, as seen in the exploitation of an Oracle PeopleSoft zero-day affecting universities.
Steps for teams running EBS 12.2
Oracle and Horizon3.ai both say the fix is to apply the October 2026 patches listed in My Oracle Support Note KA923. Until that is done, Horizon3.ai recommends:
- Removing
/OA_HTML/AppsTCFServerfrom the EBS URL firewall allowlist. - Limiting access to the EBS web tier to trusted networks.
- Watching for unauthenticated POST requests to the servlet that load
oracle.apps.jtf.gantt.server.GanttDataServer, followed by database activity. - Looking for SQL reconnaissance soon after unauthenticated web requests, unexpected files in
$APPLPTMP, and theoracleaccount starting/bin/shthrough the Concurrent Manager.
Horizon3.ai warns that these steps only reduce exposure and do not replace patching. Internal EBS servers are also at risk if an attacker can reach the servlet from another compromised machine.
