Skip to content
eastbaycyber

Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.

Oracle E-Business Suite RCE Targeted After October Patch

Breaking news 4 min read
EC
East Bay Cyber Editorial Team Updated Developing story
Built from the vendor or authority notice plus independent reporting; unconfirmed claims are labeled as reported. Human-reviewed after publishing.

TL;DR - CVE-2026-101767 affects Oracle E-Business Suite’s Oracle Application Object Library, according to Horizon3.ai. - Horizon3.ai describes an unauthenticated SQL injection that can be chained to remote code execution. - Oracle released patches addressing the issue in its October 2026 Critical Patch Update on October 20, 2026, according to Horizon3.ai. - Defused Cyber reportedly observed exploratory exploits on October 27, 2026.

What happened#

CVE-2026-101767 is described by Horizon3.ai as an unauthenticated SQL injection vulnerability in Oracle E-Business Suite that can be chained to achieve remote code execution. The affected component is identified as Oracle Application Object Library, Core. The vulnerability involves the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. Horizon3.ai says the endpoint is permitted through the default EBS URL firewall configuration. Horizon3.ai

According to Horizon3.ai, exploitation requires network access over HTTP or HTTPS, with no authentication or user interaction required. A crafted request can execute SQL with the privileges of the APPS database user and enable operating system command execution with the privileges of the EBS application account.

The Hacker News reports that threat actors are beginning to probe the vulnerability, citing threat intelligence firm Defused Cyber. The report says Defused Cyber observed exploratory exploits against CVE-2026-101767 on October 27, 2026. The Hacker News

Oracle’s October 2026 Critical Patch Update Pre-Release Announcement states that the update was scheduled for release on Tuesday, October 20, 2026, and says Oracle strongly recommends that customers apply Critical Patch Update patches as soon as possible. Oracle

Are you affected#

Horizon3.ai lists Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3 through 12.2.15, inclusive, as affected. It lists the issue as fixed in Oracle’s October 2026 Critical Patch Update, released on October 20, 2026. Horizon3.ai directs customers to apply patches applicable to their installation using Oracle E-Business Suite patch availability documentation referenced in the advisory, My Oracle Support Note KA923. Horizon3.ai

Internet-facing EBS web tiers present the most direct exposure, according to Horizon3.ai. Internal deployments may also be at risk if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.

Horizon3.ai assigns CVE-2026-101767 a CVSS 3.1 score of 9.8, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The Oracle pre-release announcement provided here does not identify CVE-2026-101767 or list affected EBS versions.

What is confirmed and what is reported#

Claim Source Status
Oracle’s October 2026 Critical Patch Update was scheduled for release on October 20, 2026, and Oracle strongly recommends applying its patches as soon as possible. Oracle Confirmed
CVE-2026-101767 affects Oracle Application Object Library in Oracle E-Business Suite versions 12.2.3 through 12.2.15, inclusive. Horizon3.ai Reported
CVE-2026-101767 is an unauthenticated SQL injection that can be chained to remote code execution. Horizon3.ai Reported
The vulnerability can allow SQL execution as the APPS database user and operating system commands as the EBS application account. Horizon3.ai Reported
Defused Cyber observed exploratory exploits against CVE-2026-101767 on October 27, 2026. The Hacker News Reported
Oracle addressed CVE-2026-101767 in its October 2026 Critical Patch Update. Horizon3.ai Reported

What defenders should do now#

  1. Identify Oracle E-Business Suite installations using Oracle Application Object Library versions 12.2.3 through 12.2.15, inclusive, as listed by Horizon3.ai.

  2. Apply the applicable Oracle October 2026 Critical Patch Update patches. Oracle recommends applying Critical Patch Update patches as soon as possible, and Horizon3.ai references Oracle E-Business Suite patch availability documentation in My Oracle Support Note KA923. Oracle Horizon3.ai

  3. Until applicable patches are installed, remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist, as recommended by Horizon3.ai.

  4. Restrict access to the EBS web tier to trusted networks and apply access restrictions across untrusted network paths to the servlet. Horizon3.ai says these measures reduce exposure but do not replace patching.

  5. Review EBS application host and database activity for unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.

  6. Look for SQL reconnaissance shortly after unauthenticated web requests, including activity involving the database version, current user, or directory objects.

  7. Check for unexpected files in $APPLPTMP and for the oracle account spawning /bin/sh through the Concurrent Manager to run operating system commands.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

Last verified: 2026-10-28

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.