[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEwmDKGgjRhOyIsUXsWPB04Eph8Oj9QxgK7q2XuMm7B0":3},{"article":4,"iocs":47,"watch_terms":58,"solutions":59,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"15d15ed4-ceba-428f-9e75-f79a9c296d13","Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)","exploitation-attempts-against-recently-patched-oracle-ebs-flaw-have-begun-cve-20-1991cd","Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw. “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,” Defused posted on X, noting that no public report of the flaw being attempted in the wild had existed before. About CVE-2026-101767 The flaw carries a CVSS score of 9.8 and … More → The post Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) appeared first on Help Net Security.","Exploitation attempts have commenced against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) vulnerability. This critical flaw, an unauthenticated SQL injection chaining to remote code execution, has a CVSS score of 9.8. Oracle has released patches, but attackers are reportedly targeting unpatched systems, potentially accessing sensitive financial, payroll, and HR data.","Exploitation attempts for CVE-2026-101767, a critical Oracle EBS flaw, have begun.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F10\u002F29\u002Foracle-e-business-suite-cve-2026-101767-exploitation\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2025\u002F10\u002F12113306\u002Foracle-eye-1500.webp","2026-10-29T13:12:24+00:00","2026-10-29T14:00:15.120301+00:00",9,[17,20,23,26],{"name":18,"type":19},"Oracle E-Business Suite","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":25},"Cl0p","threat_actor",{"name":27,"type":28},"SQL injection","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48,52,55],{"type":49,"value":50,"context":51},"cve","CVE-2026-101767","Oracle EBS SQL injection vulnerability",{"type":49,"value":53,"context":54},"CVE-2025-61882","Previous Oracle EBS vulnerability exploited by Cl0p",{"type":49,"value":56,"context":57},"CVE-2026-46817","Oracle EBS Payments module vulnerability",[21,18],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":120,"name":121,"problem":122,"products":123},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",[149,155],{"slug":150,"name":151,"logo_path":152,"roles":153},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[154],"reported_by",{"slug":156,"name":21,"logo_path":157,"roles":158},"oracle","\u002Fvendor-logos\u002Foracle.png",[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":172},"oracle-ebs-critical-sqli-to-rce-flaw-under-active-exploitation","Oracle EBS Critical SQLi-to-RCE Flaw Under Active Exploitation","A critical unauthenticated SQL injection vulnerability (CVE-2026-101767) in Oracle E-Business Suite, carrying a CVSS score of 9.8, is now being actively exploited against organizations that have not yet applied Oracle's available patch. The flaw requires no authentication, meaning attackers can chain SQL injection directly to remote code execution with no user interaction, dramatically lowering the barrier to compromise. Sensitive financial, payroll, and HR data stored in EBS systems is at immediate risk of exfiltration or manipulation. This incident underscores a recurring failure pattern: patches are released but not applied quickly enough, leaving a dangerous window of exposure on internet-facing enterprise systems. The speed at which exploitation followed disclosure highlights that threat actors monitor patch releases and reverse-engineer fixes to develop exploits within days.",[165,166,167,168,169,170,171],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":173,"PCI DSS Requirement 6":174,"NIST SP 800-53 SI-2: Flaw Remediation":175,"OWASP A06:2021 Vulnerable and Outdated Components":176,"CIS Control 7: Continuous Vulnerability Management":177,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":178,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":179},"NIS2 requires entities to implement vulnerability handling and patching policies as part of their cybersecurity risk management measures, making the delayed patching of a critical EBS flaw a potential compliance failure for in-scope organizations.","Given EBS stores financial and payroll data, PCI DSS Requirement 6 mandates timely patching of systems in scope and protection of public-facing applications, both of which are directly violated by running unpatched EBS exposed to the internet.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined timeframes, directly addressing the failure to patch a 9.8 CVSS vulnerability before attackers exploited it.","This exploit targets an unpatched component of Oracle EBS, a textbook example of the risk OWASP A06 warns against when organizations fail to track and update software dependencies and enterprise platforms.","A formal continuous vulnerability management program with enforced patching timelines for critical-severity flaws would have ensured the Oracle patch was applied before active exploitation began.","A.8.8 mandates timely identification and remediation of technical vulnerabilities; compliance with this control would have required patching CVE-2026-101767 promptly upon Oracle's disclosure.","The vulnerability is unauthenticated, meaning no credentials were required to exploit it; enforcing strict access controls and limiting EBS exposure to authenticated, authorized network paths would have significantly reduced exploitability."]