Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
- Severity
- Critical
- Sources
- 6
What happened
CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Oracle EBS Thin Client Framework servlet, found by Horizon3.ai. It allows SQL execution as the APPS database user and then OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update, and Defused Cyber reported exploratory attempts against its decoys on 27 October. Defenders should apply the October CPU to EBS promptly and, as the articles note that patching does not remove attackers already present, check for web shells and other signs of compromise. Separately, ZDI says the PeopleSoft zero-day exploited by ShinyHunters (CVE-2026-35273) covers three distinct flaws, and it is coordinating with Oracle on separate CVEs.
For security analysts · Written by AI from 6 sources · Wrong?
What to do
- Check whether you use the affected product, and install the vendor’s fix when it is available. Open your watchlist
General advice for this kind of story
Full story timeline · 6 updates
- Tue 20 OctoberCVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code ExecutionHorizon3.ai
- Wed 28 OctoberHackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security PatchThe Hacker News
- Oracle Corporation security advisory (AV26-1071) – Update 1Canadian Centre for Cyber Security
- Oracle celebrates end of Cybersecurity Awareness Month with quadruple troubleThe Register (Security)
- CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the WildOrca Security Blog
- Thu 29 OctoberExploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)Help Net Security
Who reported · 6 outlets
Who and what is in it
Threat actors