A critical vulnerability in Oracle E-Business Suite (CVE-2026-101767, CVSS 9.8) is already being actively probed by threat actors just days after Oracle released a patch. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to achieve remote code execution, potentially exposing sensitive financial, payroll, HR, and procurement data. Users are strongly advised to apply the patch immediately or implement available workarounds, such as blocking access to the vulnerable endpoint and restricting network access to the EBS web tier.
