Oracle EBS: first exploitation attempts against CVE-2026-101767

A week after the October Critical Patch Update, one of the critical Oracle E-Business Suite (EBS) flaws fixed on 20 October is already being targeted. Threat intelligence company Defused reported on X that its EBS decoy systems recorded the first exploratory exploits against CVE-2026-101767 on the morning of 27 October: an unauthenticated SQL injection that can lead to remote code execution. The news was picked up by SecurityWeek, BleepingComputer, The Hacker News, The Register, heise Security and Help Net Security.

In our article on the October CPU this CVE was not among the five priority issues highlighted by INCIBE-CERT: for E-Business Suite we had flagged CVE-2026-101809, in the Workflow Notification Mailer. There is now a concrete reason not to postpone this one either.

What we know about the exploitation

For now these are attempts, not confirmed compromises:

• Defused saw “exploratory” exploits against its own decoys, not successful attacks against companies; BleepingComputer describes them as Internet scanning for unpatched systems.
• According to BleepingComputer, Oracle has not yet flagged the CVE as exploited; The Register asked Oracle whether it had documented any successful attacks and did not receive an immediate reply.
• SecurityWeek and Help Net Security point out that before Defused’s report there were no public accounts of exploitation.

There are two exposure figures, and both need care. Shadowserver counts over 670 EBS instances reachable from the Internet, most of them with US IP addresses, without being able to say how many are honeypots or already patched (BleepingComputer). Censys, in its 28 October advisory cited by Help Net Security, counts 2,246 web properties running EBS: each hostname and port combination counts separately, so there are fewer actual servers, and the data shows neither version nor patch status.

Technical details

• CVE: CVE-2026-101767, CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (assigned by Oracle).
• Product: Oracle Application Object Library (Core component) of Oracle E-Business Suite.
• Affected supported versions: 12.2.3 to 12.2.15.
• Vector: network, over HTTP, with no credentials and no user interaction. According to the official description, a successful attack results in takeover of Application Object Library.
• Vulnerable endpoint: according to Defused and Horizon3.ai, the Thin Client Framework servlet, /OA_HTML/AppsTCFServer.

The flaw was discovered by Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai and reported to Oracle on 24 July, according to Help Net Security. The chain described by the researchers:

1. a crafted request to the vulnerable servlet executes SQL with the privileges of the APPS database user;
2. the attacker can read or modify application data accessible to APPS;
3. the same chain allows operating system commands to be executed with the privileges of the EBS application account.

Depending on the deployment, Horizon3.ai warns, the affected data may include financial, payroll, HR and procurement records.

A difference in classification: the NVD entry, still awaiting analysis, lists CWE-287 and CWE-306 (improper or missing authentication) as weaknesses, while researchers and news outlets describe a SQL injection.

MITRE ATT&CK (our classification): T1595.002 (Vulnerability Scanning) for the search for exposed systems, T1190 (Exploit Public-Facing Application) for the exploitation, T1059 (Command and Scripting Interpreter) for command execution on the application server.

Why EBS attracts attackers

The sources recall the precedents. In 2025 the Cl0p group exploited CVE-2025-61882 as a zero-day to steal data from organisations running EBS; according to SecurityWeek the campaign potentially affected over 100 organisations across many sectors, from energy and finance to manufacturing and telecommunications. In June 2026 Defused had already observed attempts against CVE-2026-46817, in the File Transmissions component of the Payments module. According to BleepingComputer, since November 2021 CISA has added 46 Oracle vulnerabilities to its KEV catalogue, 13 of which have also been used in ransomware attacks.

In the same article The Register reports further news for Oracle customers: according to the Zero Day Initiative, the PeopleSoft flaw exploited by ShinyHunters (CVE-2026-35273) actually comprises three distinct vulnerabilities, and patching alone may not remove attackers from systems already compromised with web shells.

Impact for European and Italian companies

The sources give no figures for Europe or Italy. EBS does, however, run core administrative processes, and an Internet-reachable instance on a version from 12.2.3 to 12.2.15 without the October patch should be treated as urgent.

• NIS2: for essential and important entities, vulnerability handling is one of the measures in Article 21; if a compromise with significant impact emerges, the notification deadlines of Article 23 apply, with an early warning within 24 hours.
• GDPR: payroll and staff data are personal data; unauthorised access may require notification to the supervisory authority within 72 hours.

What to do now

1. Check the versions of all EBS instances, including test and development instances reachable from the network.
2. Apply the October CPU patches for Application Object Library, together with the one for CVE-2026-101809, which affects the same versions. Oracle recommends staying on actively supported versions and patching without delay: some past attacks succeeded precisely because customers had not applied available patches.
3. If you cannot patch right away, Horizon3.ai advises removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restricting the web tier to trusted networks.
4. Check your exposure: verify from outside whether the EBS web tier responds from the Internet and, if it does not need to, close it.
5. Look for signs of compromise: Censys recommends reviewing every exposed, unpatched instance against the indicators published by Horizon3.ai. In the web tier logs, look for requests to /OA_HTML/AppsTCFServer from external addresses, especially since 27 October; in the database, unusual activity by the APPS user; on the server, processes started by the EBS application account.
6. Prepare your response: if you find traces, preserve the logs, isolate the system and assess your NIS2 and GDPR notification obligations.

How ARXDOME helps

ARX Expose and ARX Scout show which of your company’s services are exposed on the Internet and which ports are actually open: the first step to finding out whether an EBS instance can be reached from outside. ARX Radar, from the firewall logs, shows who is attacking your exposed services right now, while ARX Sentry collects logs and events from servers, useful for hunting the anomalous requests described above.

Last updated: 29 October 2026