Ing. Calogero Bono
On October 20, 2026, Oracle published its Critical Patch Update with 1295 new security patches. A few days later, on October 27, threat intelligence company Defused Cyber reported exploratory exploitation attempts against an Oracle E-Business Suite flaw, CVE-2026-101767, with a CVSS score of 9.8. This matters for anyone running Oracle's enterprise ERP, because the data at stake can include accounting, payroll and purchasing. If you have not applied the patch yet, you are in the most delicate window.
A few terms before we get into the facts. CVE is the code that uniquely identifies a vulnerability. CVSS is the 0 to 10 scale that measures its severity. RCE means remote code execution, that is, running commands on someone else's server. SQL injection is the insertion of database instructions into a web request. EBS is Oracle E-Business Suite, the business management suite.
What Oracle published in October
According to the official Oracle advisory, the Critical Patch Update contains 1295 new patches across several product families. For database products alone, it lists 14 new patches, plus those for third-party components. Of these, 4 vulnerabilities can be exploited remotely without authentication. The table includes, for example, an OpenSSL flaw in the database with a score of 9.8.
Oracle reminds customers that patches are only released for versions covered by Premier Support or Extended Support. Versions out of support are not even tested. The company also writes that it regularly receives reports of attacks against vulnerabilities that have already been fixed. In some cases attackers succeeded because customers had not applied the patches.
How does the CVE-2026-101767 flaw work?
This is an authentication problem in the Application Object Library of EBS. According to The Hacker News, researchers Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai reported it to Oracle on July 24, 2026.
The attack chain
Horizon3.ai describes it as an unauthenticated SQL injection in the Thin Client Framework servlet, which can be chained into remote code execution. A specially crafted request sent to the path /OA_HTML/AppsTCFServer allows SQL to run with the privileges of the APPS database user. From there, an attacker can reach operating system commands with the privileges of the EBS application account.
Which data is at risk
Horizon3.ai warns that, depending on the installation, the data involved can include financial records, payroll, human resources and purchasing. Systems exposed to the internet are the most at risk. Internal systems can also be hit if an attacker reaches the servlet from a compromised machine or from another network segment.
Who is scanning for vulnerable systems?
Defused Cyber stated that its decoy systems recorded exploratory exploits against CVE-2026-101767 on October 27. BleepingComputer notes that Oracle has not yet marked the flaw as actively exploited. Shadowserver tracks more than 670 exposed EBS instances, mostly with US addresses, but does not say how many are decoys or already protected.
The context matters. Sources recall that CVE-2025-61882 was used by the Clop extortion group, and that another PeopleSoft flaw was exploited by ShinyHunters. According to BleepingComputer, since November 2021 CISA has added 46 Oracle bugs to its list of actively exploited vulnerabilities, 13 of which were also used in ransomware attacks.
What to do if you cannot update right away
Updates remain the first response. If that is not possible, The Hacker News reports the following measures.
- Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
- Restrict access to the EBS web tier to trusted networks.
- Monitor the application host and database for signs of compromise.
Horizon3.ai also lists indicators of compromise. These include unauthenticated POST requests to /OA_HTML/AppsTCFServer, SQL reconnaissance right after, unexpected files in $APPLPTMP, and the oracle account launching /bin/sh through the Concurrent Manager. Oracle warns that blocking protocols or removing privileges can break application functions, so test first on non-production systems.
Limits to know
There is no confirmation of active exploitation from Oracle. Defused describes exploratory attempts against decoy systems, not successful breaches. We do not know how many exposed instances are still vulnerable, because Shadowserver does not distinguish them. The Oracle table we have is also truncated, so we cannot report every vulnerability in the cycle. The picture may change quickly, especially if public exploit code appears.
What changes for those working with digital tech
If your company or a client uses EBS, the patch is no longer something to schedule, it is something to do now. The time between the fix and the scans was one week. Check whether the servlet is reachable from the internet and who can reach it from the internal network.
Those who build integrations on EBS should rebuild their inventory of instances and versions. Those who manage servers for others need to know which systems are out of support, because no patches will arrive for them. On the organizational side, a hosting plan with managed security updates can take some of this constant catching up off the company's shoulders. We already covered the topic of attackers automating the search for flaws when discussing autonomous AI hackers and Italian SMEs.
Our take
The story is not the flaw itself, but the speed. One week from patch to the first probes means that the quarterly calendar of many companies is too slow for exposed software. Oracle is right to insist on applying patches without delay, but an advisory with 1295 fixes is hard to digest for a small company with a single sysadmin.
We have one criticism. Central business systems, full of payroll and supplier data, often remain reachable from networks that are far too broad, because nobody wants to touch them. Reducing the exposed surface costs less than any incident. Those without an internal team should treat software security in the company as a continuous process, not a one-off intervention.
Frequently asked questions
Is CVE-2026-101767 already being actively exploited?
There is no official confirmation. Oracle has not marked it as exploited yet, but Defused Cyber recorded exploratory attempts on October 27 against its own decoy systems.
How serious is the flaw?
It has a CVSS score of 9.8. According to BleepingComputer, it allows an unauthenticated attacker with HTTP access to take control of the system with low-complexity attacks.
Which systems are involved?
Oracle E-Business Suite, in particular the Application Object Library and the Thin Client Framework servlet. The sources provided do not list the affected versions here, so check the Oracle advisory.
What can I do if I cannot apply the patch?
Remove the path /OA_HTML/AppsTCFServer from the firewall allowlist and restrict access to the web tier to trusted networks. Monitor hosts and databases. Test every change first on a non-production environment.
Are internal systems at risk too?
Yes. According to The Hacker News, an internal system can be hit if an attacker reaches the servlet from a compromised machine or from another network segment.
Three moves for the coming weeks
In the coming months, watch whether Oracle and CISA classify the flaw as actively exploited, and whether public exploits appear. In the meantime, start here.
- Apply the October Critical Patch Update to EBS instances, starting with the exposed ones.
- Check your logs for requests to /OA_HTML/AppsTCFServer and the indicators published by Horizon3.ai.
- List the versions that are out of support and plan the upgrade.
