Hackers now scanning systems for recently-patched Oracle flaw

Security researchers have detected threat actors actively scanning the internet for Oracle E-Business Suite servers still vulnerable to CVE-2026-101767, just days after Oracle shipped a fix. The flaw resides in the Application Object Library's Thin Client Framework servlet and allows unauthenticated attackers with HTTP access to achieve remote code execution via SQL injection, in attacks described as low-complexity. Oracle patched the issue in its October 20 Critical Patch Update and is urging customers to apply it without delay, while threat-intel firm Defused reported spotting exploitation attempts against its EBS honeypots on October 27. Shadowserver currently counts more than 670 internet-exposed EBS instances, mostly in the US, though it's unclear how many remain unpatched, as Oracle products have repeatedly been targeted in large-scale breaches by groups like Clop and ShinyHunters.