Critical Oracle E-Business Suite flaw probed days after October patch

A critical, unauthenticated vulnerability in Oracle E-Business Suite (EBS) is being probed by attackers just days after Oracle shipped a fix, The Hacker News reported on October 28, 2026. Because EBS handles financial, payroll, HR and procurement records for large organizations, researchers are urging administrators to patch without delay.

What happened

The flaw, tracked as CVE-2026-101767 and rated 9.8 on the CVSS scale, is an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet, part of the Oracle Application Object Library component. According to The Hacker News, it can be chained to remote code execution. Oracle addressed it in its October 2026 Critical Patch Update. The company credited Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai, who reported the issue to Oracle on July 24, 2026.

Technical details

Horizon3.ai said that an attacker with network access to the TCF servlet at /OA_HTML/AppsTCFServer can run SQL as the APPS database user and then execute operating-system commands as the EBS application account. That gives an intruder the ability to read or modify any application data the APPS account can reach and to run commands on the host. The Hacker News notes that internet-facing deployments carry the most risk, but internal systems can also be hit from a compromised host or a reachable network segment.

Is it being exploited

Threat intelligence firm Defused Cyber said its EBS decoy systems recorded exploratory exploit attempts against the flaw on October 27, 2026, which The Hacker News describes as threat actors beginning to probe for it. Horizon3.ai listed indicators of compromise that include unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the GanttDataServer class followed by database activity, SQL reconnaissance such as queries for the database version and current user, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through the Concurrent Manager. The report comes against a backdrop of heavy targeting of EBS: The Hacker News notes that two other critical flaws, CVE-2025-61882 and CVE-2026-46817 (both 9.8), have been actively exploited over the past year, with the Cl0p ransomware and extortion group leveraging CVE-2025-61882.

What to do

Horizon3.ai and The Hacker News advise updating to the latest version as soon as possible. For organizations that cannot patch immediately, the recommended stopgaps are to remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restrict access to the EBS web tier to trusted networks, and monitor the application host and database for the listed signs of compromise.