Active exploitation begins against critical Oracle EBS SQL injection CVE-2026-101767

1. Executive summary

Defused reported on 27 October 2026 that its Oracle E-Business Suite decoys recorded exploratory exploitation attempts against CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework servlet that chains to remote code execution. The flaw is rated CVSS 9.8 CRITICAL in NVD and affects the Application Object Library in EBS 12.2.3 through 12.2.15; Oracle fixed it in the October 2026 Critical Patch Update published 20 October. CVE-2026-101767 is not in CISA KEV and EPSS stands at 1%, so the observed activity is probing rather than confirmed mass exploitation, but the same suite has been hit twice in eighteen months through adjacent components: CVE-2025-61882 (CVSS 9.8, in CISA KEV since 2025-10-06, EPSS 100%) was exploited as a zero-day, and CVE-2026-46817 (CVSS 9.8, in CISA KEV since 2026-07-15, EPSS 12%) was exploited in June. EMEA financial services firms running internet-facing EBS carry finance, payroll, HR and procurement data reachable by the APPS database user, which is what an attacker gains on success.

2. Regulatory framing

3. Technical analysis & attack chain

CVE-2026-101767 is an unauthenticated SQL injection in the Thin Client Framework servlet of Oracle E-Business Suite, reachable over HTTP, that chains to remote code execution. NVD records it as CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function); Horizon3.ai and Defused describe the mechanism as SQL injection, and both classifications describe the same flaw: the servlet accepts requests without authentication and passes attacker-controlled input into SQL. The CVSS 9.8 CRITICAL rating is the NVD value.

Confirmed steps, as far as the sources establish them:

1. The attacker reaches the vulnerable servlet, /OA_HTML/AppsTCFServer, over HTTP. No authentication is required.
2. The attacker submits SQL through the servlet. Horizon3.ai states the attacker can run SQL as the APPS database user.
3. Running as APPS gives read and modify access to application data the APPS user can reach. Horizon3.ai names financial, payroll, HR and procurement records as the data at risk, depending on deployment.
4. The same access allows command execution on the application host. Horizon3.ai describes the chain to remote code execution; the sources do not give the specific mechanism by which SQL access becomes host command execution.
5. Defused's decoys recorded exploratory exploitation attempts on the morning of 27 October 2026. Defused characterised the activity as exploratory and stated no prior public report of in-the-wild attempts existed.

Affected product and versions: Oracle Application Object Library, EBS 12.2.3 through 12.2.15. The fix is in Oracle's October 2026 Critical Patch Update, published 20 October 2026. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the flaw and reported it to Oracle on 24 July 2026.

Exposure: Censys reported 2,246 web properties running EBS in its 28 October advisory. That figure counts each hostname and port separately, so the number of distinct hosts is lower, and the scan cannot show which properties run an affected release or have applied the October update. The Shadowserver Foundation figure of roughly 950 internet-exposed EBS instances cited in July reporting is a separate measurement and does not describe the current vulnerable population.

Confidence caveats. The exploitation observation is single-sourced to Defused and comes from decoy telemetry, not from a confirmed compromise of a production system. No source in this set names a threat actor, and no attribution is made here. The Cl0p reference in the reporting concerns CVE-2025-61882 in 2025, not this flaw; Cl0p has no MITRE ATT&CK profile in the data available to this advisory, so any link between Cl0p and CVE-2026-101767 activity is unconfirmed and should not be assumed. No indicators of compromise for CVE-2026-101767 are reproduced in this advisory because the source set does not contain them; Horizon3.ai has published an IoC set that clients should obtain directly.

4. Mitigation & containment

P1, within 24 hours:

• Apply the Oracle October 2026 Critical Patch Update to every EBS instance at 12.2.3 through 12.2.15. This is the only remediation; there is no configuration workaround that closes the SQL injection.
• Where the patch cannot be applied immediately, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict the web tier to trusted networks, per Horizon3.ai's interim guidance. Confirm the servlet is not reachable from the internet after the change.
• Inventory every internet-facing EBS instance and record its patch level. Censys's 2,246 web properties cannot tell you which of your own hosts are affected; only your own asset data can.
• For any instance that was internet-facing and unpatched between 20 and 29 October, review it for compromise using Horizon3.ai's published IoC set and treat APPS-user data access as in scope for the review.

P2, within 72 hours:

• Review EBS web and database logs for requests to /OA_HTML/AppsTCFServer from unexpected source addresses, and for SQL errors or unusual query patterns attributable to the APPS user.
• Check database audit records for APPS-user reads or writes against financial, payroll, HR and procurement tables outside normal application behaviour.
• Confirm that no EBS instance in the estate runs an unsupported release; Oracle's own guidance is to stay on actively supported versions.

P3, within 7 days:

• Add the Thin Client Framework servlet path to continuous external attack surface monitoring so that any re-exposure is detected.
• Fold the Oracle EBS patch cadence into the third-party risk review under DORA Art. 28, with evidence of CPU application dates per instance.

5. Indicators of compromise

No indicators of compromise for CVE-2026-101767 are available in the source material. Horizon3.ai has published an IoC set; obtain it from Horizon3.ai directly and verify before enforcement, as it is single-sourced.

Behavioural indicators:

6. Detection

The sources give one usable artefact for detection: the servlet path. A YARA rule is not appropriate here because no file-level strings are published. The Sigma rule below matches HTTP requests to the vulnerable servlet path in web access logs; tune the false-positive filter to your own EBS URL firewall allowlist before enabling.

title: Oracle EBS Thin Client Framework servlet access (CVE-2026-101767)
id: 7c1e4b2a-9f3d-4a61-8e2b-0d5c6a7b1f42
status: experimental
description: Detects HTTP requests to the Oracle E-Business Suite Thin Client Framework servlet named as the vulnerable component in CVE-2026-101767. Tune to expected internal sources.
author: Adverse Trace
date: 2026-10-29
references:

  - https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation/
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/OA_HTML/AppsTCFServer'
  condition: selection
falsepositives:

  - Legitimate internal integrations that call the Thin Client Framework servlet from trusted networks
level: high

CVE assessment

3 referenced CVEs — 2 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• Help Net Security, "Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)", 2026-10-29. https://www.helpnetsecurity.com/2026/10/29/oracle-e-business-suite-cve-2026-101767-exploitation/
• The Hacker News, "Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch", October 2026. https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html
• The Register, "Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released", 2026-07-02. https://www.theregister.com/cyber-crime/2026/07/02/oracle-e-business-suite-was-under-attack-via-critical-flaw-before-the-public-exploit-code-was-even-released/5265710
• Help Net Security, "Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)", 2026-06-30. https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/
• The Hacker News, "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild", June 2026. https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html

8. Adverse Trace position

Adverse Trace assesses CVE-2026-101767 as CVSS 9.8 CRITICAL with confirmed exploratory exploitation but no CISA KEV listing and EPSS at 1%; the exploitation claim rests on Defused decoy telemetry alone and no actor is attributed. The client impact is concentrated in firms with internet-facing EBS at 12.2.3 through 12.2.15 that have not applied the October 2026 CPU, where the APPS user's reach into finance, payroll, HR and procurement data is the exposure that matters. We will obtain Horizon3.ai's IoC set and re-issue this advisory if it contains atomic indicators suitable for the §5 block, and we will track CISA KEV status for CVE-2026-101767 and report any change. Clients should confirm their EBS patch level to Adverse Trace so we can tell you whether your estate matches the exposed population.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.