Attackers Probe Oracle E-Business Suite for Critical Flaw

Threat intelligence firm Defused Cyber reported that attackers began probing the Internet for systems unpatched against a critical Oracle E-Business Suite vulnerability. The flaw, identified as CVE-2026-101767 with a CVSS score of 9.8, involves improper authentication in the Oracle Application Object Library. Oracle patched the issue last week during its Critical Patch Update. Defused Cyber noted that their decoys recorded exploratory exploits against the vulnerability on October 27.

The vulnerability allows an attacker with network access to the Thin Client Framework servlet to execute SQL as the APPS database user. This enables the execution of operating system commands as the EBS application account. Successful exploitation permits reading or modifying application data, which may include financial, payroll, HR, and procurement records. Horizon3.ai researchers discovered and reported the flaw to Oracle on July 24, 2026.

Users are advised to update to the latest version immediately. Workarounds include removing the specific servlet from the URL firewall allowlist or restricting web tier access to trusted networks. Over the past year, two other critical Oracle EBS flaws have faced active exploitation, including one leveraged by the Cl0p ransomware crew.