Attackers probe critical Oracle EBS flaw days after patch release

Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), just days after Oracle released the fix. The vulnerability, identified as CVE-2026-101767, carries a CVSS score of 9.8 and allows for unauthenticated remote code execution. Security firm Defused Cyber reported active exploitation attempts on October 27, 2026, highlighting the rapid response of attackers to enterprise software patches.

What happened

Oracle addressed this security gap in its Critical Patch Update released last week. The flaw resides in the Oracle Application Object Library, specifically involving improper authentication mechanisms. Researchers Brandon Peterson, Jimi Sebree, and Noah King from Horizon3.ai discovered the issue and reported it to Oracle on July 24, 2026. Despite the patch being available, threat intelligence indicates that malicious actors are already scanning for vulnerable systems.

Defused Cyber noted that their decoy systems recorded exploratory exploits targeting this specific vulnerability on the morning of October 27. The attack vector involves an unauthenticated SQL injection within the Thin Client Framework (TCF) servlet. This initial breach can be chained to achieve full remote code execution, giving attackers significant control over the affected server. The speed at which these probes appeared underscores the high value attackers place on compromising enterprise resource planning systems.

Horizon3.ai explained that the vulnerability permits an attacker with network access to the TCF servlet to execute SQL commands as the APPS database user. From there, the attacker can escalate privileges to run operating system commands as the EBS application account. This chain of exploitation bypasses standard authentication checks, allowing unauthorized users to interact directly with the backend database and the underlying host system.

Key details

• Vulnerability ID: CVE-2026-101767 with a CVSS severity score of 9.8.
• Attack Vector: Unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer.
• Impact: Allows execution of SQL as the APPS user and OS commands as the EBS application account.
• Data at Risk: Financial, payroll, HR, and procurement records accessible to the APPS database user.
• Discovery: Reported by Horizon3.ai researchers on July 24, 2026; patched by Oracle in late October 2026.
• Active Exploitation: Defused Cyber detected probing attempts on October 27, 2026.

Background

Oracle E-Business Suite is a comprehensive set of business applications used by many large organizations for managing finance, human resources, and supply chain operations. Because it handles sensitive corporate data, it is a frequent target for cybercriminals. The specific component affected here, the Thin Client Framework, facilitates communication between the web interface and the backend database. When authentication controls in such frameworks fail, attackers can inject malicious SQL commands to manipulate or extract data without needing valid credentials.

Remote code execution (RCE) is one of the most severe types of security vulnerabilities. It allows an attacker to run arbitrary commands on the server hosting the application. In this case, the attacker gains the permissions of the EBS application account. While this may not always equate to full root access, it is sufficient to read or modify critical business data and potentially pivot to other parts of the internal network. Previous critical flaws in EBS, such as CVE-2025-61882, have been leveraged by ransomware groups like Cl0p, making timely patching essential.

Why it matters

For teams managing self-hosted enterprise software, this incident illustrates the narrow window between patch release and active exploitation. Attackers often reverse-engineer patches to create exploit scripts within hours or days. If your organization runs Oracle EBS, delaying the update exposes your financial and HR data to immediate risk. Even internal-facing instances are vulnerable if an attacker gains a foothold elsewhere in the network, as the exploit does not require internet-facing exposure to succeed once inside the perimeter.

The nature of the data at stake amplifies the impact. Compromised payroll and HR records can lead to identity theft, fraud, and significant regulatory penalties. Furthermore, operating system access allows attackers to install persistent backdoors or ransomware. For IT leaders, this reinforces the need for robust vulnerability management processes that prioritize critical patches for customer-facing and data-heavy applications. Relying solely on perimeter firewalls is insufficient when the vulnerability allows unauthenticated access to core services.

What you can do

• Apply the latest Oracle Critical Patch Update immediately to address CVE-2026-101767.
• If patching is not immediately possible, remove /OA_HTML/AppsTCFServer from your URL firewall allowlist.
• Restrict access to the EBS web tier to trusted networks only, blocking external access.
• Monitor your EBS application host and database for unusual activity, such as unexpected files in $APPLPTMP.
• Watch for unauthenticated POST requests to the TCF servlet and subsequent SQL reconnaissance queries.
• Verify that the oracle account is not spawning /bin/sh via the Concurrent Manager, which indicates compromise.