Hackers Probe Patched Oracle E-Business Suite Flaw CVE-2026-101767

Threat actors have begun probing a newly patched critical vulnerability in Oracle E-Business Suite, according to Defused Cyber. The flaw, CVE-2026-101767, is an unauthenticated SQL injection in the Thin Client Framework servlet that can chain to remote code execution. Defused Cyber said its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on October 27.

What the vulnerability allows

The vulnerability is in the Oracle Application Object Library of Oracle E-Business Suite. Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King discovered and reported it to Oracle on July 24, 2026. An attacker with network access to the affected Thin Client Framework servlet can execute SQL as the APPS database user, then run operating system commands as the EBS application account. A crafted request to the vulnerable servlet at /OA_HTML/AppsTCFServer can run SQL with APPS privileges and enable system command execution with EBS application account privileges. Successful exploitation can let an attacker read or modify application data accessible to APPS and execute commands on the application host. Depending on deployment, affected data may include financial, payroll, HR, and procurement records. Operating system access is governed by permissions of the compromised EBS application account. Internet-facing deployments present the most risk, but internal systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.

Patching and temporary workarounds

Oracle patched CVE-2026-101767 last week as part of its Critical Patch Update. Users are advised to update to the latest version as soon as possible. If immediate patching is not an option, Horizon3.ai lists workarounds: remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist; restrict access to the EBS web tier to trusted networks; and monitor the EBS application host and database for signs of compromise.

Indicators of compromise

Horizon3.ai shared indicators of compromise. They include unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity. They also include SQL reconnaissance shortly after unauthenticated web requests, such as database version, current user, and directory objects. Another indicator is unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands.

Prior EBS flaws targeted

Vulnerabilities in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product, CVE-2025-61882 and CVE-2026-46817, both with CVSS scores of 9.8, have come under active exploitation. The former was leveraged by the Cl0p ransomware and extortion crew.

Sources: The Hacker News