Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update.
Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.
“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS’s Thin Client Framework servlet that chains to remote code execution, this morning, October 27,” Defused Cyber said in an X post.
In an advisory for the vulnerability, Horizon3.ai described it as an unauthenticated SQL injection vulnerability that could be chained to achieve remote code execution.
“The vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS application account,” the cybersecurity company said.
Specifically, an attacker can issue a crafted request to the vulnerable TCF servlet at “/OA_HTML/AppsTCFServer” to run SQL with the privileges of the APPS database user and ultimately enable system command execution with the privileges of the EBS application account.
Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host.
“Depending on the deployment, affected data may include financial, payroll, HR, and procurement records. Operating system access is governed by the permissions of the compromised EBS application account,” Horizon3.ai warned.
While internet-facing EBS deployments present the most risk, internal EBS systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.
Users are advised to update to the latest version as soon as possible. If immediate patching is not an option, the following workarounds can be applied –
- Remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist.
- Restrict access to the EBS web tier to trusted networks.
- Monitor the EBS application host and database for signs of compromise.
Horizon3.ai has also shared the below indicators of compromise –
- Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer), followed by backend database activity.
- SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects).
- Unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands.
Vulnerabilities in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew.
