Oracle E-Business Suite CVE-2026-101767: Probing Begins Seven Days After the October Patch

An unauthenticated attacker with HTTP or HTTPS access to an Oracle E-Business Suite 12.2.3 through 12.2.15 web tier can run SQL as the APPS database user and then run operating system commands as the EBS application account. The flaw is CVE-2026-101767, scored 9.8 (CVSS 3.1), and Oracle fixed it in its October 2026 Critical Patch Update, released October 20.

On October 27, Defused Cyber said its Oracle E-Business Suite decoys "recorded exploratory exploits against CVE-2026-101767", according to The Hacker News. That is probing against a honeypot, not a confirmed compromise of a real deployment, and neither Horizon3.ai nor Defused Cyber's post, as reported, names a victim.

What the flaw is and what it needs

Horizon3.ai's advisory places the bug in Oracle Application Object Library, Core, in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer). Its vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the weaknesses are CWE-89 (SQL injection) and CWE-306 (missing authentication for a critical function).

The score is accurate for the preconditions as written: network access, no credentials, no user interaction. The servlet is permitted through the default EBS URL firewall configuration, Horizon3.ai says, so an instance does not need to have been loosened to be reachable. Internet-facing web tiers are the direct exposure; internal deployments are at risk once an attacker reaches the servlet from another segment.

Timeline from July 24 to October 27

Date	Event
July 24, 2026	Horizon3.ai discloses the zero-day to Oracle
October 20, 2026	Oracle publishes the October 2026 CPU with the fix (My Oracle Support Note KA923)
October 27, 2026	Defused Cyber decoys record exploratory exploits
October 28, 2026	The Hacker News reports the probing

The researchers credited are Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai. The gap between report and patch was 88 days. The gap between patch and probing was seven.

What an attacker gets

Horizon3.ai says an attacker can read or change application data reachable by the APPS user, which may include financial, payroll, HR and procurement records. OS access then follows the permissions of the EBS application account. The advisory describes the final step as running OS commands, reached through the Concurrent Manager.

The Hacker News notes that two earlier EBS flaws scored 9.8, CVE-2025-61882 and CVE-2026-46817, and that both were exploited. CVE-2025-61882 was used by the Cl0p ransomware group. Defused Cyber's observation is not the same claim, and nothing fetched ties the current probing to Cl0p or any named group.

Indicators and mitigations for CVE-2026-101767

The fix is the October CPU. Horizon3.ai's interim guidance, which it says does not replace patching, is to remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restrict the web tier to trusted networks, and monitor the application host and database.

Its indicators of compromise are three. Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by database activity. SQL reconnaissance (database version, current user, directory objects) shortly after unauthenticated web requests. Unexpected files in $APPLPTMP, or the oracle account spawning /bin/sh through the Concurrent Manager.

For other October timelines where attackers moved quickly, see our reports on PHP2Shell attempts that Amazon saw four days before a patch and the LiteLLM release that drew 49,000 downloads in under two hours. Oracle's own CPU page returned an error when fetched, so its patch numbers are not reproduced here. Operators should read them from My Oracle Support Note KA923.