Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Security firm Defused Cyber has detected attackers scanning for a newly disclosed critical flaw in Oracle E-Business Suite just days after Oracle shipped a fix in its October Critical Patch Update. The bug, tracked as CVE-2026-101767 (CVSS 9.8), is an unauthenticated SQL injection in the EBS Thin Client Framework servlet reachable at /OA_HTML/AppsTCFServer, which lets an attacker run SQL as the APPS database account and then execute operating system commands under the EBS application identity. Researchers Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai reported the issue to Oracle back in July, and the company has released indicators of compromise including suspicious Gantt data-server activity, post-request SQL recon, and unexpected files under $APPLPTMP. Given that EBS has already been a favored target this year via CVE-2025-61882 (exploited by the Cl0p group) and CVE-2026-46817, organizations are urged to patch immediately or, if that's not feasible, block the vulnerable servlet, limit web-tier access to trusted networks, and watch for the listed compromise indicators.