Hackers Probe Critical Oracle EBS Flaw a Week After Patch: Versions at Risk

Attackers are already probing a critical Oracle E-Business Suite (EBS) vulnerability, just one week after Oracle released a security patch.

Threat intelligence firm Defused Cyber detected exploratory exploitation attempts targeting CVE-2026-101767 on October 27, 2026. Rated 9.8 on the CVSS scale, the vulnerability affects EBS versions 12.2.3 through 12.2.15 and could allow unauthenticated attackers to execute commands remotely.

The flaw threatens enterprise systems handling financial, procurement, and operational data. Although researchers have observed exploitation attempts, no successful production compromise specifically involving CVE-2026-101767 has been publicly confirmed.

How the Oracle EBS flaw enables remote code execution

Defused Cyber recorded the attempts in its EBS decoy systems, according to SecurityWeek's October 28 report. The activity followed Oracle's October 20 Critical Patch Update.

The vulnerability affects the Core component of Oracle Application Object Library. Horizon3.ai researchers, who reported the flaw to Oracle on July 24, identified an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet.

Attackers with network access to the servlet can execute SQL statements with the privileges of the EBS APPS database account. Researchers demonstrated that the flaw can be chained to execute operating system commands with the privileges of the EBS application account.

A separate Oracle SQL injection attack documented in August demonstrated how abuse of database functionality can lead to remote code execution (RCE).

The affected EBS endpoint, /OA_HTML/AppsTCFServer, is permitted by the default URL firewall configuration. Exploitation could expose sensitive records, enable unauthorized data changes, or disrupt enterprise operations.

BleepingComputer reported that the Shadowserver Foundation identified more than 670 internet-exposed EBS instances, mostly associated with U.S. IP addresses. The count does not establish how many remain unpatched or vulnerable.

Affected Oracle EBS versions and mitigation steps

Oracle's October 2026 security advisory identifies versions 12.2.3 through 12.2.15 as affected. Exploitation requires no authentication or user interaction and has low attack complexity.

Administrators should consult My Oracle Support Note KA923 for patch instructions. Oracle's August security release addressed 943 vulnerabilities across its products, underscoring the patching demands facing enterprise administrators.

Security teams should prioritize six measures:

• Apply and verify security patches. Install applicable October updates and confirm remediation across affected environments.
• Restrict vulnerable endpoints. Remove /OA_HTML/AppsTCFServer from the URL firewall allowlist until patched. Restrict web-tier access to trusted networks.
• Strengthen segmentation and access controls. Isolate critical EBS components and review unnecessary service-account privileges without disrupting required functions.
• Monitor for exploitation. Investigate suspicious servlet requests, unexpected database activity, unauthorized files, and unusual command execution.
• Assess supporting systems and recovery readiness. Review applicable Oracle Database and Fusion Middleware patches, protect backups, and test restoration procedures.
• Test incident response plans. Validate procedures for investigating exploitation, isolating hosts, preserving evidence, and restoring services.

Network restrictions cannot replace patching. A separate PeopleSoft campaign involving a firewall bypass demonstrated how attackers could evade filtering rules protecting unpatched systems.

With probing already underway, organizations should verify EBS patch deployment and investigate suspicious activity against affected installations.

Also read: Organizations reviewing enterprise vulnerability exposure should assess Splunk's October security fixes, which address additional critical vulnerabilities and remote code execution risks.