Hackers are actively probing a significant vulnerability in the Oracle E-Business Suite (EBS), which allows them to execute commands without authentication. On October 27, 2026, threat intelligence company Defused reported detecting these exploit attempts on its decoy networks. Although these activities suggest potential security risks, there have been no confirmed breaches of customer systems.
Oracle’s Response to the Vulnerability
The vulnerability, identified as CVE-2026-101767, has been assigned a critical Common Vulnerability Scoring System (CVSS) score of 9.8. First discovered by Horizon3.ai, the flaw was communicated to Oracle on July 24. Oracle addressed the issue with a patch released on October 20 as part of their October Critical Patch Update. The vulnerability, initially reported as a zero-day, was already publicly disclosed and patched when Defused noticed the exploit attempts.
Technical Details and Potential Impact
The flaw impacts the Core component of the Oracle Application Object Library within EBS versions 12.2.3 to 12.2.15. It requires network access via HTTP or HTTPS but does not necessitate user credentials or interaction. This vulnerability resides in the Thin Client Framework servlet, accessible at /OA_HTML/AppsTCFServer, and can be exploited through a crafted request that triggers SQL injection, allowing database command execution as the influential APPS user. This access can extend to executing operating system commands under the EBS application account.
The ramifications of a successful exploit are extensive, potentially jeopardizing financial, payroll, human resources, and purchasing records associated with the APPS user. While the commands executed do not automatically provide administrative control over the host, they pose significant security risks to sensitive data.
Preventive Measures and Recommendations
Defused observed these exploit attempts as exploratory rather than indicative of confirmed data breaches. Historically, Oracle EBS has been targeted by malicious actors, as evidenced by previous attacks like the Cl0p exploitation of a different Oracle EBS zero-day (CVE-2025-61882). To mitigate the current threat, administrators are urged to apply the October patches promptly.
Horizon3.ai recommends temporarily removing the vulnerable servlet from the EBS URL firewall allowlist and restricting access to trusted networks until patches are applied. Vigilance is advised regarding unauthenticated POST requests to GanttDataServer and unexpected file appearances in $APPLPTMP. Additionally, monitoring for the oracle account executing /bin/sh via Concurrent Manager is crucial. While these measures reduce exposure, they should complement timely patching.
As artificial intelligence accelerates the pace of cyberattacks, organizations must ensure their defense strategies can respond effectively at machine speed.
