A security firm says its decoy servers saw the first exploit attempts against a critical Oracle E-Business Suite bug on the morning of October 27, 2026. The bug is CVE-2026-101767, which Oracle fixed in the October Critical Patch Update only a week earlier.
The flaw scores 9.8 out of 10 and needs no login. Any team that runs EBS 12.2 and has not yet applied the October update should treat this as urgent, because the gap between a public patch and real attacks has become very short.
What Happened
Defused Cyber said honeypot servers it runs to imitate EBS received early test requests for CVE-2026-101767 on October 27. The Hacker News covered the report on October 28.
These were probing attempts on decoy systems. The reports do not say that any real customer system was breached or that a wide campaign is under way. Still, probing usually comes before larger scanning.
Oracle shipped the fix on October 20, 2026 inside a Critical Patch Update that holds 1,295 new security patches. Horizon3.ai found the bug and reported it to Oracle on July 24, 2026.
How the Vulnerability Works
The problem sits in the Thin Client Framework (TCF) servlet of Oracle Application Object Library. The servlet answers at the path /OA_HTML/AppsTCFServer, and the default EBS URL firewall setup lets that path through.
A crafted HTTP request to this servlet can run SQL as the APPS database user. From there, an attacker can move on to running operating system commands as the account that owns the EBS application.
No credentials and no user interaction are needed. All the attacker requires is network access to the web tier. Oracle's risk matrix lists the affected versions as 12.2.3 through 12.2.15.
What Is at Risk
The APPS user can reach most of the application data, so a successful attack may expose or change records in finance, payroll, HR and procurement. Command execution on the host adds a second layer of damage, limited by what the EBS OS account is allowed to do.
Internet-facing servers carry the highest risk. Internal installations are not safe either, since an attacker who lands on another machine in the network can still reach the servlet.
EBS has been hit before. Over the past twelve months, attackers abused two older critical bugs in this product, CVE-2025-61882 and CVE-2026-46817, and the Cl0p extortion group was behind use of the first.
What It Means for Developers and DBAs
If you own an EBS 12.2 environment, the order of work is simple. Patch first, then reduce exposure, then look for signs of earlier abuse. The October 2026 update covers far more than this one bug, with 194 new fixes for EBS alone, and 31 of them can be reached remotely without authentication.
Oracle also says the EBS exposure depends on the Database and Fusion Middleware versions underneath, so those components need the October update as well. The patch steps for EBS are in My Oracle Support Note KA923.
Many teams wait for a maintenance window before patching. When exploit attempts are already visible, shorten that wait and test the patch on a clone of production in parallel.
Workarounds If You Cannot Patch Today
Horizon3.ai lists three stopgap steps. They lower the risk but do not replace the patch.
- Take the /OA_HTML/AppsTCFServer path off the allowed list of the EBS URL firewall.
- Allow only trusted networks to reach the web tier.
- Watch the application host and the database for signs of compromise.
Before you remove the path, check with your application owners, because the servlet belongs to a standard EBS framework component and some features may use it.
Signs of Compromise to Look For
Horizon3.ai published indicators that you can search for in web and database logs.
- POST requests without a login to /OA_HTML/AppsTCFServer that load the class oracle.apps.jtf.gantt.server.GanttDataServer, with database activity right after.
- Queries for the database version, current user or directory objects shortly after such anonymous web calls.
- Files you do not recognise in $APPLPTMP, or the oracle account launching /bin/sh via the Concurrent Manager.
Conclusion
CVE-2026-101767 moved from a fresh patch to observed probing in about a week. Install the October 2026 patch bundle on your EBS 12.2 systems, use the URL firewall change if you need more time, and check your logs for the listed indicators.
Sources
- The Hacker News: Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch
- Horizon3.ai: CVE-2026-101767 Oracle EBS SQL Injection RCE
- Oracle Critical Patch Update Advisory - October 2026
See my articles more often when you search Google.
