[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:oracle-ebs-cve-2026-101767-unauthenticated-rce-now-being":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"oracle-ebs-cve-2026-101767-unauthenticated-rce-now-being","rapid-alert","Oracle EBS CVE-2026-101767: unauthenticated RCE now being probed, patch is the October CPU","Attackers began probing for CVE-2026-101767, a CVSS 9.8 SQL injection in Oracle E-Business Suite that chains to remote code execution, one week after Oracle patched it. Over 670 EBS instances are exposed. Apply the October 2026 CPU now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Foracle-ebs-cve-2026-101767-unauthenticated-rce-now-being-24318bd5-cover.png","Oracle EBS 101767 rapid alert: Oracle EBS on the internet? One request runs as the APPS user.","Marcus Lenngren","2026-10-28T14:44:21.327+00:00","![Oracle EBS 101767 rapid alert: Oracle EBS on the internet? One request runs as the APPS user.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Foracle-ebs-cve-2026-101767-unauthenticated-rce-now-being-24318bd5-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOracle patched a critical flaw in E-Business Suite (EBS) on 20 October 2026 in its October Critical Patch Update. The flaw, CVE-2026-101767, carries a CVSS score of 9.8. It is an SQL injection in the Core component of Oracle Application Object Library, reachable over HTTP or HTTPS without any login or user interaction.\n\nOne week later, on 27 October, threat intelligence firm Defused reported that its Oracle EBS decoys recorded exploratory exploit attempts. These are probes, not confirmed breaches. By 28 October, BleepingComputer reported internet-wide scanning for unpatched systems.\n\nThe vulnerable endpoint is the Thin Client Framework servlet at \u002FOA_HTML\u002FAppsTCFServer. A crafted request triggers SQL injection, letting an attacker send database commands as the powerful APPS database user. That access can be chained into operating system command execution under the EBS application account. Horizon3.ai discovered and reported the issue to Oracle on 24 July.\n\n## Timeline\n\n- 24 Jul 2026: Horizon3.ai reports the flaw to Oracle.\n- 20 Oct 2026: Oracle fixes it in the October CPU and urges immediate patching.\n- 27 Oct 2026: Defused decoys log exploratory exploits.\n- 28 Oct 2026: Scanning reported across the internet; Shadowserver tracks over 670 exposed EBS instances, most in the United States.\n\n## Am I affected?\n\nThe flaw affects Oracle EBS versions 12.2.3 through 12.2.15. You are exposed if an EBS instance is reachable over HTTP or HTTPS and the October 2026 CPU is not applied.\n\nThe default URL firewall permits the \u002FOA_HTML\u002FAppsTCFServer endpoint, so a stock configuration leaves it reachable. Commands run with the application account's permissions rather than automatically granting full administrative control over the host, but the impact still reaches financial, payroll, human resources and purchasing records accessible to APPS.\n\nOracle has not yet tagged CVE-2026-101767 as exploited in the wild, and so far only probes have been observed, not confirmed breaches or stolen data.\n\n## What to do now\n\n1. Apply the Oracle October 2026 Critical Patch Update to every EBS instance. This is the fix.\n2. If you cannot patch immediately, remove the servlet from the EBS URL firewall allowlist, as Horizon3.ai advises.\n3. Restrict web access to EBS to trusted networks only.\n4. Confirm which EBS version you run and whether it falls in 12.2.3 to 12.2.15.\n5. If you find evidence of exploitation, preserve evidence and treat the application tier as compromised. Patching closes the door but does not by itself evict an attacker already inside.\n\n## How to hunt\n\n- Review unauthenticated POST requests invoking GanttDataServer, especially when followed by database queries.\n- Look for unexpected files in $APPLPTMP.\n- Watch for the oracle account launching \u002Fbin\u002Fsh through Concurrent Manager.\n- Check your URL firewall configuration to confirm whether \u002FOA_HTML\u002FAppsTCFServer is still permitted.\n\n## What does not help\n\nAccess restrictions and removing the servlet from the URL firewall allowlist reduce exposure but do not replace patching. Horizon3.ai and Oracle are clear that the October CPU is the fix. Note also the lesson from the related PeopleSoft campaign, where ShinyHunters bypassed path-based web application firewall rules by url-encoding a single character. Do not rely on a WAF path block as your control.\n\n## Sources\n\n- [ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fshinyhunters-exploited-oracle.html), The Hacker News, 28 Oct\n- [Hackers now scanning systems for recently-patched Oracle flaw](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-now-scanning-systems-for-recently-patched-oracle-flaw\u002F), BleepingComputer, 28 Oct\n- [Hackers Start Probing Fresh Oracle EBS Vulnerability](https:\u002F\u002Fwww.securityweek.com\u002Fhackers-start-probing-fresh-oracle-ebs-vulnerability\u002F), SecurityWeek, 28 Oct\n- [Hackers Actively Exploiting New Oracle EBS RCE Vulnerability](https:\u002F\u002Fcybersecuritynews.com\u002Foracle-ebs-rce-exploited\u002F), Cyber Security News, 28 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]