Skip to content
audiotale.net
Sign in
NewsNews

CVE-2026-101767: Oracle E-Business Suite SQL injection probed after patch

Defused Cyber saw exploratory attacks on 27 October against a critical unauthenticated Oracle EBS flaw fixed on 20 October; here is who is affected and what to check.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. How the attack path works
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Sources

Attackers have started probing for CVE-2026-101767, a critical unauthenticated SQL injection in Oracle E-Business Suite (EBS) that Oracle fixed in its October 2026 Critical Patch Update. Threat intelligence firm Defused Cyber says its EBS decoy systems recorded "exploratory exploits" against the flaw on the morning of 27 October, one week after the patch. Oracle has not marked the bug as exploited, CISA has not listed it, and nobody has reported a confirmed breach. But EBS runs finance, payroll, HR and procurement for large organisations, and earlier EBS bugs were abused within days, so anyone running version 12.2 who has not applied the October update should treat this as urgent.

Key points

  • CVE-2026-101767 is an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet of Oracle E-Business Suite that can be chained to remote code execution, according to Horizon3.ai, the firm that found it.
  • Oracle rates it CVSS 3.1 9.8 and lists supported versions 12.2.3 through 12.2.15 as affected, in the Oracle Application Object Library "Core" component, reachable over HTTP with no login.
  • The fix shipped in Oracle's Critical Patch Update of 20 October 2026; Horizon3.ai says it reported the bug to Oracle on 24 July 2026.
  • Defused Cyber reported exploratory attempts against its decoys on 27 October 2026; this is probing of a patched bug, not a confirmed compromise of a real customer.
  • CISA's Known Exploited Vulnerabilities (KEV) catalog, in its 27 October 2026 release, does not list CVE-2026-101767.

What to do

  • Who is affected: Oracle E-Business Suite 12.2.3 through 12.2.15, the supported releases in Oracle's advisory. Oracle's notes cover supported versions only, so older releases should be treated as at risk as well.
  • Fix: apply the October 2026 Critical Patch Update (published 20 October 2026) to every EBS environment, including test, clone and disaster recovery copies that are reachable on a network. The patch details are in Oracle's advisory, linked below.
  • If you cannot patch today: Horizon3.ai's interim advice, as reported by The Hacker News, is to remove /OA_HTML/AppsTCFServer (the servlet backed by oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist, restrict the EBS web tier to trusted networks, and monitor the application host and database. These steps reduce exposure; they do not replace the patch.
  • How to check whether you were probed: Horizon3.ai lists three indicators. First, unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the class oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity. Second, SQL reconnaissance (database version, current user, directory objects) shortly after unauthenticated web requests. Third, unexpected files in $APPLPTMP, or the oracle account spawning /bin/sh through the Concurrent Manager.

What happened

Oracle released its October 2026 Critical Patch Update on 20 October. Among the fixes for Oracle E-Business Suite is CVE-2026-101767. Oracle's risk matrix lists it under Oracle Application Object Library, component Core, with the protocol HTTP, no privileges required and no user interaction. The base score is 9.8 and the impact is high for confidentiality, integrity and availability. The supported versions affected are 12.2.3 to 12.2.15. The Oracle advisory credits three researchers from Horizon3.ai for the bug: Brandon Peterson, Jimi Sebree and Noah King.

Horizon3.ai published its own advisory the same day. It describes an unauthenticated SQL injection in the TCF servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. An attacker with network access can run SQL as the APPS database user, then run operating system commands as the EBS application account. Horizon3.ai adds that this endpoint is permitted through the default EBS URL firewall configuration. The firm says affected data may include financial, payroll, HR and procurement records, and that operating system access depends on the permissions of the compromised application account.

On 28 October, BleepingComputer and The Hacker News reported that Defused Cyber saw the first attempts. In the words The Hacker News quotes from Defused's post, its EBS decoys "recorded exploratory exploits against CVE-2026-101767" on the morning of 27 October. We could not open the original post on X, so we rely on those two outlets for the wording. BleepingComputer adds that the Shadowserver Foundation tracks more than 670 internet-exposed EBS instances, mostly with US addresses; Shadowserver does not say how many are already patched or are honeypots themselves.

Background

E-Business Suite has been a repeat target. The Hacker News notes that over the past year two other critical EBS flaws, CVE-2025-61882 and CVE-2026-46817, both scored 9.8 and came under active exploitation, the first by the Cl0p ransomware and extortion crew. The exploitation of CVE-2025-61882 in October 2025 is the best-known case. BleepingComputer also notes that CISA has added 46 Oracle bugs to the KEV catalog since November 2021, 13 of them used in ransomware attacks.

Horizon3.ai's advisory names the endpoint publicly, which tells scanners where to look. We found no public proof of concept in the sources we read. Rescana's summary of Oracle's advisory adds that Oracle says it continues to receive reports of attempts to exploit vulnerabilities that already have patches, and urges customers to apply updates without delay.

This was not the only serious EBS fix in the update. We covered the whole release in our summary of Oracle's October 2026 update. Oracle's own table for EBS shows CVE-2026-101809, in the Workflow Notification Mailer, scored 10.0, plus CVE-2026-101634 and CVE-2026-101808 at 9.1, all over HTTP and all for 12.2.3 to 12.2.15. Installing the full October update closes those at the same time.

How the attack path works

EBS is a large Java and PL/SQL application. Users reach it through a web tier, and a built-in "URL firewall" decides which paths from the internet are allowed to reach the application. Horizon3.ai says the TCF servlet's endpoint is let through by that firewall in its default configuration.

According to Horizon3.ai, the attack has three steps. A request to the servlet carries input that ends up in a SQL statement without being safely handled, which is the classic SQL injection. The injected SQL runs as APPS, the central database account that owns most EBS objects and so can read and change almost all application data. From there, the indicators show a route to the operating system: the oracle account starting /bin/sh through the Concurrent Manager, EBS's job scheduler. That is why the bug is described as a chain from SQL injection to remote code execution rather than only a data leak.

The indicator list is also a practical check. A log search for POST requests to /OA_HTML/AppsTCFServer from outside your network, and for requests mentioning the Gantt class, shows whether anyone has touched the endpoint. Finding probes does not prove a breach, and finding none does not prove safety, since not every deployment keeps full web logs.

What it means

For security teams the message is the usual one, with a deadline attached. A 9.8 bug in an internet-facing enterprise system, with the endpoint named in public and scanning already seen against decoys, is a prompt to patch within days, not at the next maintenance window. The count of exposed systems is modest: Shadowserver tracks more than 670 internet-exposed EBS instances. But the data behind them (finance, payroll, HR, procurement, per Horizon3.ai) is the kind attackers target, and Horizon3.ai notes that internal systems are at risk too if an attacker can reach the servlet from another network segment.

For organisations that cannot patch quickly, the URL firewall change is cheap, but it should be tested, because removing a path may break features that depend on it. Oracle says it provides no workaround specific to this flaw and that blocking required protocols can break functionality.

What we don't know yet

  • Whether any real customer system has been compromised. Defused saw probes against decoys; no source reports a breach.
  • Who is behind the probing. Defused does not attribute it, and neither do the outlets reporting it.
  • Whether a public exploit exists. None was reported in the sources we read, and Horizon3.ai has so far published a description and indicators rather than exploit code.
  • Whether CISA will add the bug to its KEV catalog. As of the 27 October 2026 release of the catalog, it is not listed.
  • Whether releases older than 12.2.3 are affected. Oracle covers supported versions only.

What to watch next

Watch the CISA KEV catalog for an entry for CVE-2026-101767, which would confirm exploitation against real systems and start the clock for US federal agencies. Watch for Horizon3.ai to publish a fuller technical writeup, which usually shortens the time to public exploit code. And watch Oracle's security alerts page for any change in its exploitation notes.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next