← BACK TO FEED
OracleEBSCVE-2026-101767remote code executionvulnerability exploitation

Oracle EBS Flaw Under Active Probing Days After Patch Dropped

A critical vulnerability in Oracle E-Business Suite (CVE-2026-101767, CVSS 9.8) is already being actively probed by threat actors just days after Oracle released a patch. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to achieve remote code execution, potentially exposing sensitive financial, payroll, HR, and procurement data. Users are strongly advised to apply the patch immediately or implement available workarounds, such as blocking access to the vulnerable endpoint and restricting network access to the EBS web tier.

The ink on Oracle's latest Critical Patch Update was barely dry before attackers started sniffing around a freshly patched hole in Oracle E-Business Suite. Threat intelligence firm Defused Cyber confirmed on October 27 that its EBS honeypots had already recorded exploit attempts against CVE-2026-101767, a vulnerability carrying a CVSS score of 9.8.

The flaw, discovered by researchers Brandon Peterson, Jimi Sebree, and Noah King at Horizon3.ai and reported to Oracle back in July, sits inside the Thin Client Framework (TCF) servlet. It's an unauthenticated SQL injection bug that chains neatly into remote code execution. No credentials required. Network access is all an attacker needs.

Send a crafted POST request to `/OA_HTML/AppsTCFServer` and you're running SQL as the APPS database user. From there, OS command execution follows as the EBS application account. That's not a theoretical impact chain. That's a bad afternoon for whoever runs the affected system.

What's at stake depends on the deployment, but Oracle EBS tends to sit at the heart of enterprise operations. Financial records, payroll, HR data, procurement systems. Horizon3.ai noted that internet-facing instances are the most exposed, though internal deployments aren't safe either if an attacker already has a foothold somewhere on the same network.

If you can't patch immediately, Oracle and Horizon3.ai suggest blocking `/OA_HTML/AppsTCFServer` at the URL firewall level, tightening network access to the EBS web tier, and watching both the application host and database closely for anything odd.

On the indicators front, Horizon3.ai flagged a few things worth watching: unauthenticated POST requests to the TCF servlet spinning up the Gantt data-server class, SQL reconnaissance activity shortly after those web hits, and unexpected files landing in `$APPLPTMP` alongside the oracle account spawning shell processes via the Concurrent Manager.

This isn't the first time EBS has been a target. Two other critical flaws in the same product, CVE-2025-61882 and CVE-2026-46817, both scored 9.8 and both saw active exploitation, with Cl0p ransomware operators getting in on the action. Oracle EBS is clearly on the threat actor shopping list. Patch it, restrict it, or accept the consequences.

READ NEXT
Oracle E-Business Suite Exploited Before Anyone Even Published the Attack CodeCISA Adds PHP2Shell RCE Flaws to Active Exploitation List as 32 Million Servers Sit UnpatchedPHP Blames Chainguard for Blowing Critical Disclosure After AI Finds Huge Vulnerabilities