Oracle shipped its October 2026 Critical Patch Update on Oct. 20, with 1,295 new security patches across its product families. Within a week, someone was already testing one of them against the internet. CVE-2026-101767 is a critical, unauthenticated flaw in Oracle E-Business Suite (EBS), and on Oct. 27 threat intelligence firm Defused Cyber said its EBS decoys recorded what it called exploratory exploits against the bug, BleepingComputer reported.

That is a short gap between patch and probing, and it matters more for EBS than for most software. EBS holds the kind of data organizations guard closely: Horizon3.ai warns that, depending on the deployment, affected data may include financial, payroll, HR and procurement records. Attackers have gone after EBS before, and it has paid off for them.

What the bug is

According to the National Vulnerability Database record, published Oct. 20, the flaw sits in Oracle Application Object Library, specifically its Core component, which is part of E-Business Suite. Supported versions 12.2.3 through 12.2.15 are affected. NVD describes it as easily exploitable by an unauthenticated attacker with network access over HTTP, and says a successful attack can result in takeover of Oracle Application Object Library.

It carries a CVSS 3.1 base score of 9.8 out of 10. The vector string tells the story in shorthand: network-reachable, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Put simply, anyone who can reach the vulnerable EBS component over the network can attempt it, with no login and no phishing click required.

The Hacker News adds technical detail. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King are credited with discovering the flaw and reporting it to Oracle on July 24, 2026. Horizon3.ai describes it as an unauthenticated SQL injection in EBS's Thin Client Framework servlet that can be chained to remote code execution. SQL injection means an attacker can smuggle their own database commands into a request the application passes to its database. According to Horizon3.ai, an attacker with network access to the affected servlet can execute SQL as the APPS database user and then run operating-system commands as the EBS application account.

In practice, Horizon3.ai says successful exploitation can let an attacker read or modify application data accessible to APPS and execute commands on the application host. The Hacker News adds that internet-facing EBS deployments carry the most risk, but internal systems can also be exploited if an attacker can reach the servlet from a compromised system or another accessible network segment.

Who is probing, and how much

The evidence of attacker interest so far is limited but worth taking seriously. Defused's decoys, fake EBS systems set up to attract and record attacks, logged exploratory attempts on Oct. 27. "Exploratory" suggests someone testing whether the technique works, not yet a broad, automated campaign. The Register also reported the Defused observations and that Horizon3 found the bug and disclosed it to Oracle.

The Shadowserver Foundation, which scans the internet for exposed systems, tracks more than 670 internet-exposed EBS instances, most of them with IP addresses in the United States. BleepingComputer notes Shadowserver does not indicate how many of those are honeypots or already secured against the flaw, so 670 is a ceiling on visible targets, not a count of vulnerable ones.

As of BleepingComputer's Oct. 28 report, Oracle had not tagged CVE-2026-101767 as exploited in the wild. The Register says it asked Oracle, among other questions, whether it has documented any successful exploitation, and did not receive an immediate response. Oracle's own advisory carries its standing warning: the company "continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches," and it strongly recommends that customers remain on actively-supported versions and apply security patches without delay.

Why EBS defenders are on edge

EBS has a recent and painful history. BleepingComputer points out that, since early August 2025, the Clop extortion gang has exploited another EBS flaw, CVE-2025-61882, in zero-day attacks. More broadly, BleepingComputer reports that CISA has added 46 Oracle security bugs to its Known Exploited Vulnerabilities (KEV) catalog since November 2021, and 13 of those have also been abused in ransomware attacks.

Oracle's month has other problems too. The Register reports that the Zero Day Initiative (ZDI) says the PeopleSoft zero-day CVE-2026-35273, which Mandiant confirmed was exploited by the ShinyHunters data theft and extortion group, actually involves three distinct vulnerabilities that ZDI researchers reported to Oracle in June. Mandiant said in late September that ShinyHunters had deployed web shells on dozens of systems globally. A web shell is a small malicious script left on a web server that gives an attacker a back door. The Register's point is that patching alone may not remove attackers from already compromised systems, particularly if they have installed web shells.

That lesson applies directly to EBS. If an exposed EBS server went unpatched during the window when CVE-2026-101767 was being probed, applying the patch closes the door but does not tell you whether anyone already got in.

What It Means for Defenders

Who is affected: Organizations running Oracle E-Business Suite, supported versions 12.2.3 through 12.2.15, are in scope. Highest risk falls on any EBS instance whose web tier can be reached from the internet, though The Hacker News notes internal systems are exposed too if an attacker can reach the servlet from elsewhere on the network. Oracle's guidance is to remain on actively-supported versions.

Patch first: Apply the EBS fixes from Oracle's October 2026 Critical Patch Update. Given the 9.8 score, the lack of authentication required and observed probing, treat this as an emergency change, not something for the next quarterly maintenance window.

If you cannot patch immediately, The Hacker News lists three workarounds:

  • Remove the /OA_HTML/AppsTCFServer entry from the EBS URL firewall allowlist, which blocks access to the vulnerable Thin Client Framework servlet.
  • Restrict access to the EBS web tier to trusted networks so it is not reachable from the open internet.
  • Monitor both the EBS application host and the database for signs of compromise.

Check for compromise: Because the flaw allows SQL execution as the APPS user and OS command execution as the EBS application account, review database activity tied to APPS and look for unexpected processes or new files created by the EBS application account, especially on exposed systems. Horizon3.ai has published indicators of compromise; see The Hacker News write-up. The PeopleSoft web-shell episode is a reminder that a patched server can still be a compromised one. If you find signs of intrusion, rotate the credentials those accounts can reach and bring in incident response before assuming you are clean.

For federal contractors and CMMC shops: If EBS holds controlled unclassified information or contract financials, document the patch date, any interim mitigations and your compromise review. Watch CISA's KEV catalog; if CVE-2026-101767 is added, federal remediation deadlines would follow.

The good news is that the fix exists and the probing so far looks exploratory. With Oracle's EBS track record, that window may not stay open long.

Sources