Defused records exploratory exploits against Oracle E-Business Suite flaw CVE-2026-101767

Defused recorded exploratory exploits against CVE-2026-101767, a SQL injection in Oracle E-Business Suite’s Application Object Library, early on October 27, 2026, using its Oracle E-Business Suite decoys.

The flaw affects supported versions 12.2.3 through 12.2.15 and rates 9.8 on the CVSS scale. An attacker needs only network access to the /OA_HTML/AppsTCFServer servlet over HTTP or HTTPS, with no sign-in and no user action required. The request runs SQL as the APPS database user, then escalates to commands at the operating system level under the EBS application account. The flaw carries CWE-306, which means authentication is missing for a critical function.

Oracle’s October 2026 Critical Patch Update, issued October 20, 2026, contains the patch for CVE-2026-101767. Exploitation could give an attacker remote code execution and full control of the Application Object Library. Oracle has not published technical details of the flaw.

Horizon3.ai disclosed the flaw to Oracle on July 24, 2026. Oracle credited Horizon3.ai’s researchers with the report, and patches arrived roughly 88 days after that.

Internet-facing EBS web tiers face the most direct exposure, while an attacker inside the network who can reach the servlet puts internal systems at risk. The default EBS URL firewall configuration permits the servlet.

Defenders should monitor the EBS application server and database for unusual activity until they install patches. Warning signs include POST requests with no authentication to /OA_HTML/AppsTCFServer that call oracle.apps.jtf.gantt.server.GanttDataServer, then database activity. SQL reconnaissance queries arrive soon after unauthenticated web requests, asking for the database version, current user, and directory objects. Teams should scan the $APPLPTMP folder for unexplained files and look for signs that the oracle account launched /bin/sh through the Concurrent Manager.

That same update also fixed CVE-2026-101809 in the Workflow product, which carries a CVSS 3.1 score of 10.0. Oracle said 31 of its 194 new EBS patches fix flaws that attackers might exploit remotely without authentication.

Depending on the deployment, exposed data could include finance, payroll, HR, or purchasing and procurement records. On October 21, 2026, CVE-2026-101767 had not been added to CISA’s Known Exploited Vulnerabilities catalog, and no exploitation in the wild had been publicly reported. As of October 21, 2026, NVD’s entry for the flaw sat at status Received, and NVD had not issued its own assessment.

Oracle E-Business Suite has been a repeat target. In June 2026, Defused said attackers were exploiting CVE-2026-46817, which sits in the File Transmissions part of EBS Payments, and attackers were caught exploiting it during the weekend of June 27-28, 2026. The May 2026 Critical Security Patch Update, released May 28, 2026, included Oracle’s fix for CVE-2026-46817, and CISA added that flaw to its Known Exploited Vulnerabilities catalog, listing it on July 15, 2026.

Oracle points customers to My Oracle Support Note KA923 to get the patches, and says to apply the October 2026 CPU to EBS’s Oracle Database and Fusion Middleware components too. Until defenders install patches, they can pull /OA_HTML/AppsTCFServer off the URL firewall allowlist and limit access to the EBS web tier to trusted networks. Oracle has issued no workaround specific to this flaw, and its advisory warns that blocking network protocols can lower risk until patching but may break functionality. Oracle says it has not tested releases outside Premier Support or Extended Support, and earlier versions are likely affected as well.