Summary
Threat actors have begun probing a newly patched critical flaw in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The bug, CVE-2026-101767 (CVSS 9.8), sits in the Oracle Application Object Library and was fixed in Oracle's October 2026 Critical Patch Update.
Defused Cyber recorded exploratory attempts against its EBS decoys on October 27, 2026, only days after the patch shipped.
Technical Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-101767 |
| CVSS | 9.8 |
| Component | Oracle Application Object Library (Thin Client Framework servlet) |
| Type | Unauthenticated SQL injection, chainable to remote code execution |
| Vulnerable path | /OA_HTML/AppsTCFServer |
| Reported by | Horizon3.ai (reported to Oracle July 24, 2026) |
An attacker with network access to the servlet can run SQL as the APPS database user and then execute operating system commands as the EBS application account. Data at risk includes financial, payroll, HR, and procurement records. Internal systems are also exposed if an attacker can reach the servlet.
Indicators of Compromise
- Unauthenticated POST requests to
/OA_HTML/AppsTCFServerthat instantiate theGanttDataServerclass, followed by database activity - SQL reconnaissance shortly after unauthenticated web requests, such as queries for the database version, current user, or directory objects
- Unexpected files in
$APPLPTMP - The
oracleaccount spawning/bin/shthrough the Concurrent Manager
Context
This is not the first critical EBS bug to be exploited. CVE-2025-61882 (used by the Cl0p ransomware gang) and CVE-2026-46817 (both CVSS 9.8) were previously exploited in the wild.
Recommendations
- Apply the October 2026 Critical Patch Update to all EBS instances as soon as possible.
- If patching is delayed, remove
/OA_HTML/AppsTCFServerfrom the URL firewall allowlist. - Restrict access to the EBS web tier to trusted networks and keep it off the internet.
- Hunt for the indicators above on the application host and in the database.