Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

Oracle E-Business Suite RCE Probed After October Patch

Breaking news 5 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - Since the last update, Oracle’s published advisory lists Oracle E-Business Suite versions 12.2.3 through 12.2.15 as affected, and The Hacker News reports exploratory exploitation was observed on October 27, 2026. - Horizon3.ai describes CVE-2026-101767 as an unauthenticated SQL injection in Oracle E-Business Suite that can be chained to remote code execution. - Horizon3.ai says the issue affects Oracle Application Object Library, Core, and was addressed in Oracle’s October 2026 Critical Patch Update, released on October 20, 2026. - Internet-facing EBS web tiers have the most direct exposure, but internal deployments may also be reachable from compromised systems or other accessible network segments.

What happened#

CVE-2026-101767 is described by Horizon3.ai as an unauthenticated SQL injection vulnerability in Oracle E-Business Suite that can be chained to achieve remote code execution. The affected component is Oracle Application Object Library, Core. The vulnerability involves the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. Horizon3.ai says the endpoint is permitted through the default EBS URL firewall configuration. Horizon3.ai

Exploitation requires network access over HTTP or HTTPS, with no authentication or user interaction required, according to Horizon3.ai. A crafted request can execute SQL with the privileges of the APPS database user and enable operating system command execution with the privileges of the EBS application account. Successful exploitation can allow an attacker to read or modify application data accessible to APPS and execute commands on the application host. Depending on the deployment, Horizon3.ai says affected data may include financial, payroll, HR, and procurement records.

The Hacker News reports that threat actors are beginning to probe the vulnerability, citing threat intelligence firm Defused Cyber. The report says Defused Cyber observed exploratory exploits against CVE-2026-101767 on October 27, 2026. The Hacker News

Oracle’s October 2026 Critical Patch Update lists Oracle E-Business Suite versions 12.2.3 through 12.2.15 as affected. Oracle says the update contains 1295 new security patches and strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Oracle

Are you affected#

Oracle’s October 2026 Critical Patch Update lists Oracle E-Business Suite versions 12.2.3 through 12.2.15 as affected. The advisory provides a patch availability document for Oracle E-Business Suite, but the supplied Oracle page does not identify CVE-2026-101767 by ID or state the fixed version. Oracle

Horizon3.ai says Oracle addressed CVE-2026-101767 in the October 2026 Critical Patch Update, released on October 20, 2026. It directs customers to apply patches applicable to their installation using the Oracle E-Business Suite patch availability documentation referenced in My Oracle Support Note KA923. Horizon3.ai

Internet-facing EBS web tiers present the most direct exposure, according to Horizon3.ai. Internal deployments may also be at risk if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.

Horizon3.ai assigns CVE-2026-101767 a CVSS 3.1 score of 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What is confirmed and what is reported#

Claim Source Status
Oracle’s October 2026 Critical Patch Update lists Oracle E-Business Suite versions 12.2.3 through 12.2.15 as affected. Oracle Confirmed
Oracle strongly recommends that customers remain on actively-supported versions and apply security patches without delay. Oracle Confirmed
CVE-2026-101767 affects Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3 through 12.2.15, inclusive. Horizon3.ai Reported
CVE-2026-101767 is an unauthenticated SQL injection that can be chained to remote code execution. Horizon3.ai Reported
The vulnerability can allow SQL execution as the APPS database user and operating system commands as the EBS application account. Horizon3.ai Reported
Horizon3.ai says Oracle addressed CVE-2026-101767 in its October 2026 Critical Patch Update, released on October 20, 2026. Horizon3.ai Reported
Defused Cyber observed exploratory exploits against CVE-2026-101767 on October 27, 2026. The Hacker News Reported

What defenders should do now#

  1. Identify Oracle E-Business Suite installations using versions 12.2.3 through 12.2.15, as listed in Oracle’s October 2026 Critical Patch Update.

  2. Apply the applicable Oracle October 2026 Critical Patch Update patches. Oracle recommends applying security patches without delay. Horizon3.ai references the Oracle E-Business Suite patch availability documentation in My Oracle Support Note KA923. Oracle Horizon3.ai

  3. Until applicable patches are installed, remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist, as recommended by Horizon3.ai.

  4. Restrict access to the EBS web tier to trusted networks and apply access restrictions across untrusted network paths to the servlet. Horizon3.ai says these measures reduce exposure but do not replace patching.

  5. Monitor the EBS application host and database for unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.

  6. Look for SQL reconnaissance shortly after unauthenticated web requests, including activity involving the database version, current user, or directory objects.

  7. Check for unexpected files in $APPLPTMP and for the oracle account spawning /bin/sh through the Concurrent Manager to run operating system commands.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against Oracle’s guidance for your environment.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-10-30

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.