What happened
Oracle patched a critical flaw in E-Business Suite (EBS) on 20 October 2026 in its October Critical Patch Update. The flaw, CVE-2026-101767, carries a CVSS score of 9.8. It is an SQL injection in the Core component of Oracle Application Object Library, reachable over HTTP or HTTPS without any login or user interaction.
One week later, on 27 October, threat intelligence firm Defused reported that its Oracle EBS decoys recorded exploratory exploit attempts. These are probes, not confirmed breaches. By 28 October, BleepingComputer reported internet-wide scanning for unpatched systems.
The vulnerable endpoint is the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. A crafted request triggers SQL injection, letting an attacker send database commands as the powerful APPS database user. That access can be chained into operating system command execution under the EBS application account. Horizon3.ai discovered and reported the issue to Oracle on 24 July.
Timeline
- 24 Jul 2026: Horizon3.ai reports the flaw to Oracle.
- 20 Oct 2026: Oracle fixes it in the October CPU and urges immediate patching.
- 27 Oct 2026: Defused decoys log exploratory exploits.
- 28 Oct 2026: Scanning reported across the internet; Shadowserver tracks over 670 exposed EBS instances, most in the United States.
Am I affected?
The flaw affects Oracle EBS versions 12.2.3 through 12.2.15. You are exposed if an EBS instance is reachable over HTTP or HTTPS and the October 2026 CPU is not applied.
The default URL firewall permits the /OA_HTML/AppsTCFServer endpoint, so a stock configuration leaves it reachable. Commands run with the application account's permissions rather than automatically granting full administrative control over the host, but the impact still reaches financial, payroll, human resources and purchasing records accessible to APPS.
Oracle has not yet tagged CVE-2026-101767 as exploited in the wild, and so far only probes have been observed, not confirmed breaches or stolen data.
What to do now
- Apply the Oracle October 2026 Critical Patch Update to every EBS instance. This is the fix.
- If you cannot patch immediately, remove the servlet from the EBS URL firewall allowlist, as Horizon3.ai advises.
- Restrict web access to EBS to trusted networks only.
- Confirm which EBS version you run and whether it falls in 12.2.3 to 12.2.15.
- If you find evidence of exploitation, preserve evidence and treat the application tier as compromised. Patching closes the door but does not by itself evict an attacker already inside.
How to hunt
- Review unauthenticated POST requests invoking GanttDataServer, especially when followed by database queries.
- Look for unexpected files in $APPLPTMP.
- Watch for the oracle account launching /bin/sh through Concurrent Manager.
- Check your URL firewall configuration to confirm whether /OA_HTML/AppsTCFServer is still permitted.
What does not help
Access restrictions and removing the servlet from the URL firewall allowlist reduce exposure but do not replace patching. Horizon3.ai and Oracle are clear that the October CPU is the fix. Note also the lesson from the related PeopleSoft campaign, where ShinyHunters bypassed path-based web application firewall rules by url-encoding a single character. Do not rely on a WAF path block as your control.
Sources
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws, The Hacker News, 28 Oct
- Hackers now scanning systems for recently-patched Oracle flaw, BleepingComputer, 28 Oct
- Hackers Start Probing Fresh Oracle EBS Vulnerability, SecurityWeek, 28 Oct
- Hackers Actively Exploiting New Oracle EBS RCE Vulnerability, Cyber Security News, 28 Oct
