Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)

Security researchers have detected early exploitation attempts against CVE-2026-101767, an Oracle E-Business Suite vulnerability that Oracle fixed only days earlier. Threat intel firm Defused observed probing activity on October 27 against honeypots mimicking EBS, targeting an unauthenticated SQL injection flaw in the Thin Client Framework servlet that can escalate to remote code execution.

The bug carries a CVSS score of 9.8 and hits the Application Object Library component in EBS releases 12.2.3 through 12.2.15. It was discovered by Horizon3.ai researchers and reported to Oracle in July; a remote, unauthenticated attacker reaching the vulnerable servlet can execute SQL as the APPS database user, potentially exposing financial, payroll, HR and procurement data and gaining command execution on the host.

Oracle shipped the fix in its October 20 patch update and is urging customers to apply it without delay, warning that prior incidents involved attackers succeeding against organizations that skipped available patches. Censys counted over 2,200 internet-facing EBS web properties as of October 28, though it cannot confirm how many remain unpatched; Horizon3.ai recommends blocking the /OA_HTML/AppsTCFServer servlet and restricting web-tier access until updates are applied. EBS remains a recurring target, having previously been hit by Cl0p via CVE-2025-61882 and by attackers exploiting the Oracle Payments flaw CVE-2026-46817 earlier this year.