Oracle E-Business Suite Vulnerability: Probing Began Days After the Patch

A critical Oracle E-Business Suite vulnerability is already being probed by attackers, about a week after Oracle shipped the fix. The flaw is tracked as CVE-2026-101767. It carries a CVSS score of 9.8, and it lets an unauthenticated attacker run commands on the server that hosts your finance system.

What the Oracle E-Business Suite vulnerability allows

The bug sits in the Oracle Application Object Library, a core part of E-Business Suite (EBS). Horizon3.ai, the firm Oracle credits with the discovery, describes it as an unauthenticated SQL injection that chains to remote code execution.

The weak point is a web servlet at /OA_HTML/AppsTCFServer. An attacker sends a crafted request to it. That request runs SQL as the APPS database user. From there, the attacker can run operating system commands as the EBS application account.

No password is needed and no user has to click anything. Network access over HTTP or HTTPS is enough. Horizon3.ai also notes that the servlet is allowed by the default EBS URL firewall configuration, so a stock install is not protected by that layer.

Who is affected by this E-Business Suite bug

Supported releases 12.2.3 through 12.2.15 are affected. Oracle did not test unsupported releases, and security analysts at Rescana say they are likely vulnerable too. If you run an older EBS version, assume you are exposed and plan accordingly.

Internet-facing web tiers are the most exposed. Internal systems are not safe by default, though. An attacker who lands on any machine that can reach the servlet, such as a compromised laptop, can use the same route.

Timeline: from private report to probing in three months

Horizon3.ai reported the flaw to Oracle on 24 July 2026. Oracle released the fix on 20 October 2026 in its quarterly Critical Patch Update. Horizon3.ai then published indicators of compromise and mitigation steps.

On 27 October, the threat intelligence firm Defused Cyber said its Oracle EBS decoy systems had recorded exploit attempts against the bug. The Hacker News, which reported the story, describes them as exploratory. Nothing published so far shows confirmed theft of customer data. Still, a week from patch to probing is quick, and it fits a pattern.

EBS has been a repeat target. In 2025, Google Threat Intelligence Group and Mandiant reported that an actor claiming links to the Cl0p extortion brand attacked EBS customers. CISA also lists a different EBS flaw, CVE-2026-46817, as exploited. Rescana found no link between that bug and this one.

Why attackers target Oracle EBS

EBS holds the records that criminals want: finance, payroll, HR and procurement data. Access to the application database is often enough for extortion. Many firms run EBS on schedules built around month-end close. So patching waits for a quiet period. Attackers know this.

The systems are also complex. Few teams know which servlets are reachable from which network segment. That gap is where an Oracle EBS flaw like this thrives.

What to do now

First, apply the October 2026 Critical Patch Update to every EBS 12.2.x environment. Include disaster recovery, test and clone systems, because these often hold copies of live data. Oracle’s patch details are in My Oracle Support Note KA923.

Second, if patching must wait, cut the exposure. Horizon3.ai advises removing /OA_HTML/AppsTCFServer from the URL firewall allowlist and limiting web tier access to trusted networks. These steps reduce risk, but they do not replace the patch.

Third, look for signs of earlier compromise. Horizon3.ai lists these indicators:

• Unauthenticated POST requests to the servlet that instantiate the GanttDataServer class, followed by database activity.
• SQL reconnaissance, such as queries for the database version or current user, soon after unauthenticated web requests.
• Unexpected files in the $APPLPTMP directory.
• The oracle account spawning /bin/sh through the Concurrent Manager.

Fourth, ask your suppliers. If an outsourcer or managed service provider runs EBS for you, confirm their patch status in writing.

What this means for smaller organisations

You do not need to be a multinational to run EBS. Plenty of UK manufacturers, universities and public bodies do. They have small teams and heavily customised installs, so patches feel risky. That caution is fair. Even so, the Oracle E-Business Suite vulnerability here gives an attacker a route to the database without credentials, and a delayed patch is the larger risk.

If you cannot say today whether your EBS web tier is reachable from the internet, treat that as the first finding. Ask your infrastructure team for a list of exposed ports and paths. Then compare it with what you expect to see.

The testing angle

This is the kind of weakness that a web application penetration test is designed to surface: an exposed endpoint, an injectable parameter and a path from the database to the host. If you want to understand how SQL injection leads to this outcome, our guide to SQL injection attacks explains the mechanics. A lasting fix also needs a working patch management routine, because the next EBS flaw will arrive on its own schedule.