🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw
Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution.
⠀
The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15.
⠀
An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account.
⠀
Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information.
⠀
Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable.
⠀
Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.
Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.
Source: https://www.oracle.com/security-alerts/cpuoct2026.html
