Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
CRITICAL · VULNERABILITYCVE-2026-101767redteam/daily · 6 sources
- Severity
- Critical
- Sources
- 6
What happened
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.
For IT people · Written by AI from 6 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 6 updates
- Tue 20 OctoberCVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code ExecutionHorizon3.ai
- Wed 28 OctoberHackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security PatchThe Hacker News
- Oracle Corporation security advisory (AV26-1071) – Update 1Canadian Centre for Cyber Security
- Oracle celebrates end of Cybersecurity Awareness Month with quadruple troubleThe Register (Security)
- CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the WildOrca Security Blog
- Thu 29 OctoberExploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)Help Net Security
Who reported · 6 outlets
Horizon3.aiThe Hacker NewsCanadian Centre for Cyber SecurityThe Register (Security)Orca Security BlogHelp Net Security
Who and what is in it
Threat actors