Attackers Probe Oracle E-Business Suite Flaw One Week After Patch, Defused Cyber Says

Someone is already testing the door on Oracle's newest critical E-Business Suite bug.

Defused Cyber, a threat intelligence firm, said its Oracle EBS decoy systems recorded "exploratory exploits" against CVE-2026-101767 on the morning of Tuesday, Oct. 27. The flaw carries a CVSS score of 9.8 out of 10. Oracle fixed it seven days earlier, on Oct. 20, in its October 2026 Critical Patch Update.

What the flaw does

The bug sits in the Core component of Oracle Application Object Library and affects EBS versions 12.2.3 through 12.2.15. It needs only network access over HTTP or HTTPS. No password and no user interaction are required.

Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the problem and reported it to Oracle on July 24, 2026. Horizon3.ai describes it as an unauthenticated SQL injection in the Thin Client Framework servlet, reachable at /OA_HTML/AppsTCFServer.

A crafted request lets an attacker run SQL as the powerful APPS database user. That can be chained into operating system commands under the EBS application account, according to Horizon3.ai's advisory.

The exposed data could include financial, payroll, HR and procurement records, Horizon3.ai warned. Operating system access depends on the permissions of the compromised application account. It does not automatically mean full control of the host.

Probing is not a breach

Defused's observation is of attempts against its own decoys. It is not evidence that any customer was compromised, and no victims or data theft tied to this flaw have been reported.

Oracle has not yet tagged CVE-2026-101767 as exploited in the wild. Defused is the only party that has publicly described the Oct. 27 activity so far.

The internet watchdog Shadowserver tracks more than 670 internet-exposed Oracle EBS instances, most with U.S. IP addresses. Shadowserver does not say how many are honeypots or already patched, so the count is an upper bound on exposure and not a count of vulnerable systems.

Why defenders are not shrugging

EBS has been a repeat target. Since early August 2025, the Clop extortion gang has exploited a separate EBS flaw, CVE-2025-61882, in zero-day attacks. Victims included Logitech, GlobalLogic and the Washington Post, along with Harvard, the University of Pennsylvania, Dartmouth and the University of Phoenix.

Another EBS bug, CVE-2026-46817, also scored 9.8 and has come under active exploitation in the past year.

Oracle's other enterprise software has fared no better. In June, Oracle issued emergency mitigations for a PeopleSoft zero-day, CVE-2026-35273. The ShinyHunters extortion group exploited it between May 27 and June 9, gaining unauthenticated remote code execution and stealing data. Reported victims include Nottingham University, Nissan and the National Association of Insurance Commissioners.

Since November 2021, CISA has added 46 Oracle vulnerabilities to its list of actively exploited bugs. Thirteen of them have been used in ransomware attacks.

Oracle's position on patching

Oracle has put responsibility on the customer side of the ledger. In its advisory language, the company said: "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches." It added that it "strongly recommends that customers remain on actively-supported versions and apply security patches without delay."

That is the company's own account of past attacks. This patch is only a week old, and large enterprises often run EBS as a heavily customized finance and HR backbone. Whether each organization has applied the October update is not something Oracle or the researchers have disclosed.

What administrators are told to do

The fix is the October patch. Where that cannot happen immediately, Horizon3.ai recommends removing the servlet from the EBS URL firewall allowlist and restricting web access to trusted networks. The default URL firewall permits the endpoint, so administrators need to check their configuration rather than assume they are covered.

Horizon3.ai also lists signs of compromise:

• Unauthenticated POST requests invoking GanttDataServer, especially when followed by database queries.
• Unexpected files in $APPLPTMP.
• The oracle account launching /bin/sh through Concurrent Manager.

Internal systems are not safe by default. An attacker who reaches the servlet from a compromised machine or another network segment can exploit it too, Horizon3.ai said.

The open question is whether the Oct. 27 probes turn into confirmed intrusions. That would show up if Oracle tags the flaw as exploited or if a victim comes forward.