The Oracle E-Business Suite bug we flagged now has attackers testing it. Patch or close the servlet today

When Oracle’s October patches landed, we flagged the no-login E-Business Suite bugs as the ones to book first. One of them now has attackers testing it. Threat intelligence firm Defused says its E-Business Suite decoys recorded exploit attempts against CVE-2026-101767 on Tuesday morning.

Horizon3, which found the bug, published its details the same week, including the one URL to close if you cannot patch yet.

Attackers started testing Oracle E-Business Suite’s new SQL injection bug one week after the patch. Horizon3 says it ends in commands on the application server.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

Exploit attempts hit Oracle E-Business Suite decoys

CVE-2026-101767 is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, rated 9.8. Oracle fixed it in the October 2026 Critical Patch Update on October 20.

Horizon3 says the bug sits in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, which the default EBS URL firewall allows. A crafted request runs SQL as the APPS database user and chains to operating system commands as the EBS application account.

“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27,” Defused said, as quoted by SecurityWeek and BleepingComputer. Oracle has not marked the flaw as exploited, and Defused’s report covers decoys, not confirmed victims.

E-Business Suite 12.2 sites that publish pages to the internet

E-Business Suite holds payroll, HR, purchasing and supplier records, and companies often expose parts of it for suppliers or remote staff. BleepingComputer reports that Shadowserver tracks more than 670 internet-exposed EBS instances, most in the United States.

Attackers have a track record here. BleepingComputer recalls that the Clop gang used a different EBS flaw, CVE-2025-61882, in zero-day data theft starting in August 2025.

Apply the October patch or close the TCF servlet today

• Apply the October 2026 Critical Patch Update to every EBS 12.2.3 to 12.2.15 instance, internet-facing ones first.
• Until the patch is in, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, as Horizon3 advises, and limit the web tier to trusted networks.
• Confirm which EBS hosts the internet can reach; a supplier portal often means one can.

Details

• CVE: CVE-2026-101767, Oracle E-Business Suite, Application Object Library (Core), SQL injection, no authentication, HTTP or HTTPS, CVSS 3.1 9.8. Versions 12.2.3 to 12.2.15. Fixed in the October 2026 CPU (October 20).
• Endpoint: /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer (Horizon3).
• Timeline: reported to Oracle by Horizon3 on July 24, 2026; patched October 20; exploit attempts on Defused decoys October 27.

Hunt / verify

• Search web-tier logs for unauthenticated POST requests to /OA_HTML/AppsTCFServer, especially ones that name oracle.apps.jtf.gantt.server.GanttDataServer (a Horizon3 indicator).
• Look for SQL reconnaissance soon after such requests, such as queries for the database version, current user or directory objects.
• Check $APPLPTMP for unexpected files and process logs for the oracle account starting /bin/sh through the Concurrent Manager.

Source: Horizon3: CVE-2026-101767 details and mitigations

Sources

• Oracle: Critical Patch Update Advisory, October 2026
• Horizon3.ai: CVE-2026-101767, Oracle EBS SQL Injection RCE
• SecurityWeek: Hackers Start Probing Fresh Oracle EBS Vulnerability
• BleepingComputer: Hackers now scanning systems for recently-patched Oracle flaw
• NVD: CVE-2026-101767

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].