Hackers Scan Internet for Oracle EBS Missing October Patch

What happened

Attackers started probing a critical Oracle E-Business Suite flaw days after Oracle shipped the fix in its October 2026 Critical Patch Update. Defused recorded attempts against decoy systems on October 27. BleepingComputer reports ongoing internet scanning for unpatched systems.

Why it matters

The flaw allows unauthenticated SQL injection, chainable to remote code execution and full takeover of the component, with no credentials required. Compromised systems may expose financial, payroll, human resources, and procurement data. Shadowserver tracks more than 670 internet-exposed EBS instances.

What to do

Apply Oracle's October 2026 Critical Patch Update immediately. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

For the technical team

CVE

CVE-2026-101767

Affected

Oracle E-Business Suite (EBS) · Oracle E-Business Suite versions 12.2.3 through 12.2.15 (Oracle Application Object Library).

Exploitation

Exploratory attempts against decoy systems recorded on October 27 by Defused, one week after the patch release. BleepingComputer reports internet scanning for unpatched systems. Shadowserver tracks more than 670 internet-exposed EBS instances, with no count of how many remain vulnerable. Oracle has not classified the flaw as actively exploited; no compromises have been publicly confirmed. No other in-the-wild exploitation reports, per SecurityWeek.

Fix

Oracle's October 2026 Critical Patch Update. Mitigation if patching is delayed: restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.

Vector

Unauthenticated SQL injection over HTTP in the Thin Client Framework servlet of the EBS Application Object Library, exploitable remotely by unauthenticated attackers. The attacker executes SQL with the privileges of the APPS database user and can chain it to run operating-system commands as the EBS application account.

More details

Flaw discovered and reported by Horizon3.ai. In June, Defused warned of attacks exploiting CVE-2026-46817 in the File Transmissions component of the EBS Payments product. Last year, the Cl0p group exploited zero-days in Oracle enterprise management software in a campaign that potentially impacted over 100 organizations, per SecurityWeek.

Timeline

1. 10/28/2026 01:23 PM

   Technical details circulated alongside the scanning wave: an unauthenticated SQL injection (CVSS 9.8) in the Thin Client Framework servlet that runs SQL with APPS database user privileges and can be chained to remote code execution; affects versions 12.2.3 through 12.2.15.

2. 10/28/2026 11:03 AM

   Defused Cyber attributes the probing to CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library, patched in the October Critical Patch Update.

3. 10/28/2026 10:09 AM

   Exploit attempts were detected on decoy systems on October 27; the flaw is unauthenticated SQL injection (CVSS 9.8) that can lead to remote code execution.

Want the next updates in your inbox? Get the daily edition →

See all 5 updates

1. 10/28/2026 09:21 AM

   BleepingComputer reports attackers are still scanning the internet for unpatched systems affected by the recently fixed Oracle flaw.

2. 10/28/2026 06:20 AM

   SecurityWeek reports active probing of CVE-2026-101767 in Oracle EBS.

Sources 5 sources

• Hackers Start Probing Fresh Oracle EBS Vulnerability SecurityWeek
• @BleepinComputer @BleepinComputer
• @TheHackersNews @TheHackersNews
• Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Hacker News
• @DarkWebInformer @DarkWebInformer

See all news