Threat actors have started probing for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), threat intelligence firm Defused reports.
The exploited flaw, tracked as CVE-2026-101767 (CVSS score of 9.8), was patched last week in Oracle’s October CPU.
It is described as an SQL injection issue in the Application Object Library product of EBS that could be exploited by remote, unauthenticated attackers over HTTP.
Successful exploitation of the bug could allow attackers to achieve remote code execution (RCE) and completely take over the Application Object Library.
According to Defused, the first exploitation attempts targeting CVE-2026-101767 were observed on October 27.
“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27,” the company warned on X.
The security defect was discovered and reported by Horizon3.ai and there have been no other reports regarding its in-the-wild exploitation.
Oracle EBS vulnerabilities are often targeted by threat actors. In June, Defused warned of attacks exploiting CVE-2026-46817, a critical issue in the File Transmissions component of E-Business Suite’s Payments product.
Last year, the Cl0p ransomware and extortion group exploited zero-day bugs in Oracle’s enterprise management software to access stored data.
The large-scale EBS hacking campaign potentially impacted over 100 organizations across consumer goods, energy, engineering, entertainment, finance, heavy industry, manufacturing, media, software, technology, telecommunications, and other industries.
Related: CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Related: Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Related: HPE Patches Dozens of Critical Flaws in Networking Products
Related: iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
