1. Executive summary
Attackers have begun probing CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite that can be exploited for remote code execution, according to SecurityWeek. NVD records the flaw at CVSS 9.8 (critical) under CWE-287 (improper authentication) and CWE-306 (missing authentication for critical function). The CVE is not in CISA KEV and EPSS sits at 1%, so exploitation is not yet confirmed at scale, but the probing activity is the reconnaissance step that has preceded confirmed exploitation of a sibling EBS flaw this year. EMEA financial services firms running internet-facing EBS, particularly where the Payments module is exposed, should treat this as a live exposure question rather than a patch-cycle item.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | Probing of an internet-facing EBS instance is an ICT-related incident that must be handled under the incident management process, and the SQL injection can reach the Payments module that processes payment data | The incident management process must cover detection of probing against EBS, triage of whether the probe succeeded, and containment. Logs of the probe attempts are the evidence base. |
| DORA Art. 18 | The same event must be classified against the criteria for ICT-related incidents and cyber threats, and the outcome determines whether Art. 19 reporting is triggered | Classification must be recorded even where the probe is blocked. A probe that reaches the Payments module is a different classification from one that hits a WAF. |
| NIS2 Art. 23 | Where the entity is in NIS2 scope and the probe escalates to a significant incident, the reporting obligation applies | Reporting timelines start from awareness of the significant incident, not from the first probe. Keep the probe timeline to establish the start point. |
3. Technical analysis & attack chain
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite that can be exploited for remote code execution. The public reporting available for this item is a single SecurityWeek summary; the technical mechanism, affected EBS versions, and the specific component are not stated in that source. The following chain reflects what is confirmed and what is inferred from the sibling EBS exploitation this year.
- An attacker sends crafted HTTP requests to an internet-facing EBS endpoint. The injection is unauthenticated, so no credentials are required.
- The injection reaches a SQL context that permits code execution on the database or application tier. The exact path is not described in the source.
- Successful exploitation gives the attacker code execution in the context of the EBS application. The source does not state the privilege level obtained.
The source does not describe payloads, persistence, command-and-control, lateral movement, or data access for CVE-2026-101767. Those details are absent and should not be assumed from the sibling CVE.
The sibling CVE-2026-46817 is the relevant precedent. Defused Cyber reported first in-the-wild exploitation on 27 June 2026, roughly six weeks after Oracle's May 2026 Critical Patch Update and before any public proof-of-concept existed. The target was the Oracle Payments File Transmission component in EBS 12.2.3 through 12.2.15. The flaw carries CVSS 9.8 and allows unauthenticated attackers to read arbitrary files. Defused recorded six exploitation attempts from a single source, all using what appeared to be a working exploit, and the requests sought to retrieve sensitive files. The operator appeared to be validating the technique rather than scanning broadly. The Shadowserver Foundation reported around 950 EBS instances exposed to the public internet, mostly in the US, while noting that figure says nothing about patch state.
The exploitation of CVE-2026-46817 before public exploit code existed points to an attacker who had either reverse-engineered Oracle's patch or obtained a private exploit. That pattern is the reason probing of CVE-2026-101767 matters: the same reverse-engineering route is available to anyone who diffs the fix.
Two caveats. The Defused findings on CVE-2026-46817 are single-sourced to that vendor; the Shadowserver exposure figure is a separate single source. Neither has been independently corroborated in the material available here. No actor has been attributed to CVE-2026-101767, and no MITRE ATT&CK profile applies to any named group in this item.
4. Mitigation & containment
P1 (within 24h)
- Identify every internet-facing EBS instance and confirm whether it is on a version affected by CVE-2026-101767. The source does not state the affected version range for this CVE; obtain it from Oracle's advisory before relying on a version check.
- Where the Payments module is exposed to the internet and does not need to be, restrict access at the network edge. The sibling CVE-2026-46817 was exploited through the Payments File Transmission component, and the same exposure surface is the obvious target here.
- Search web and WAF logs for SQL injection patterns against EBS endpoints over the past 30 days. The source gives no signature, so use generic SQLi detection (UNION, stacked queries, time-based payloads) against EBS URL paths.
- Confirm whether EBS database and application logs retain the request bodies needed to determine whether a probe succeeded. If they do not, enable that logging now.
P2 (within 72h)
- Apply Oracle's fix for CVE-2026-101767 once the advisory is available. The source does not name a patch or CPU for this CVE; do not assume the May 2026 CPU covers it.
- For EBS 12.2.3 through 12.2.15, confirm the May 2026 CPU fix for CVE-2026-46817 is applied. That CVE is confirmed exploited and is the higher immediate risk.
- Review database account privileges used by the EBS application tier. The CVE is classified CWE-306 (missing authentication for critical function), so the blast radius of a successful injection depends on what that account can reach.
P3 (within 7 days)
- Add EBS endpoints to the external attack surface monitoring scope and alert on new internet-facing instances.
- Tabletop the DORA Art. 17 and Art. 18 process against an EBS probe scenario, including the decision point on whether a probe that reaches the Payments module is a reportable incident.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources describe probing activity but give no IPs, domains, URLs, hashes, or request signatures. The Defused findings on CVE-2026-46817 describe behaviour (six attempts from a single source, file-retrieval requests) but publish no atomic indicators. Any IOC set for this item would be fabricated.
6. Detection
Insufficient indicators to author detection rules.
The source gives no strings, paths, command lines, or network artefacts specific to CVE-2026-101767. A YARA or Sigma rule built from the CVE identifier or the product name would detect reporting about the threat, not the threat. Detection should be built from the client's own EBS request logs once a signature is available from Oracle or a vendor.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-101767 | 9.8 Critical | — | 1% | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported version… |
7. Sources
- SecurityWeek, "Hackers Start Probing Fresh Oracle EBS Vulnerability", 2026-10-28. https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/
- The Register, "Oracle E-Business Suite was under attack via critical flaw before the public exploit code was even released", 2026-07-02. https://www.theregister.com/cyber-crime/2026/07/02/oracle-e-business-suite-was-under-attack-via-critical-flaw-before-the-public-exploit-code-was-even-released/5265710
- SecurityWeek, "Exploitation of Recent Oracle E-Business Suite Vulnerability Begins". https://www.securityweek.com/exploitation-of-recent-oracle-e-business-suite-vulnerability-begins/
- Help Net Security, "Oracle E-Business Suite Payments flaw under attack (CVE-2026-46817)", 2026-06-30. https://www.helpnetsecurity.com/2026/06/30/oracle-payments-cve-2026-46817-exploitation/
- The Hacker News, "Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild", 2026-06. https://thehackernews.com/2026/06/oracle-e-business-suite-flaw-cve-2026.html
8. Adverse Trace position
CVE-2026-101767 is CVSS 9.8 critical, not in CISA KEV, with EPSS at 1%. The probing reported by SecurityWeek is a single-source observation and does not yet amount to confirmed exploitation. The higher immediate risk for EBS clients remains CVE-2026-46817, which is confirmed exploited and single-sourced to Defused Cyber. Adverse Trace assesses that EMEA financial services firms with internet-facing EBS, and particularly the Payments module, should treat both CVEs as one exposure question and act on the P1 items within 24 hours. We will monitor for an Oracle advisory naming the affected versions and fix for CVE-2026-101767, and for any vendor confirmation of successful exploitation, and will reissue this advisory if either appears.
Published via PulseTrace — Adverse Trace threat intelligence.