Article
Oracle E-Business Suite Vulnerability CVE-2026-101767 Is Now Being Probed
Oracle EBS 12.2.3 to 12.2.15 has an unauthenticated CVSS 9.8 vulnerability, CVE-2026-101767, and probing has begun. See who is exposed and how to patch.
Read more
Vulnerability
Oracle E-Business Suite Application Object Library Flaw (CVE-2026-101767)
A flaw in the Core component of Oracle Application Object Library, part of Oracle E-Business Suite (EBS).
- CVE ID
- CVE-2026-101767
- CVSS
- 9.8 Critical (CVSS v3.1, Oracle)
- Affected product
- Oracle E-Business Suite (Oracle Application Object Library, Core component)
- Exploited
- Unknown
- Published
- 20 October 2026
In short
CVE-2026-101767 is a flaw in the Core component of Oracle Application Object Library, part of Oracle E-Business Suite (EBS). EBS is the business software suite many companies use for finance, HR and procurement. Oracle says an attacker with no account and network access over HTTP can take over that component. It affects EBS 12.2.3 to 12.2.15, scores CVSS 9.8, and was fixed in Oracle's Critical Patch Update of 20 October 2026.
- CVECVE-2026-101767
- ProductOracle Oracle E-Business Suite (Oracle Application Object Library, Core component)
- Fix Steps5actions listedFind every EBS instance · Apply the October 2026 update
What it allows
Oracle describes an easily exploitable flaw in the Core component of Oracle Application Object Library. An unauthenticated attacker with network access over HTTP can compromise it. Oracle says a successful attack can result in takeover of Oracle Application Object Library. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Horizon3.ai credits its attack research team with the find. Its advisory says the bug sits in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer, and that the default EBS URL firewall configuration lets requests to it through. A crafted request runs SQL as the APPS database user. The attack chain can then run operating system commands as the EBS application account.
Horizon3.ai says affected data may include financial, payroll, HR and procurement records, depending on the deployment. Internet-facing web tiers are the most direct exposure, and internal systems are at risk if an attacker can reach the servlet.
Oracle's advisory does not say the flaw is exploited. SecurityWeek reported on 28 October 2026 that a threat intelligence company's decoys recorded exploratory attempts on 27 October. Our news post on the probing shows the GitHub, X and Telegram checks and the steps to take.
The same Oracle update fixed CVE-2026-101809, a CVSS 10.0 flaw in the Workflow Notification Mailer of the same EBS versions. Attackers have a record with this product: CISA lists CVE-2025-61882 as used in ransomware campaigns, and our CVE-2025-61882 page covers it. The attack pattern is exploiting a public-facing application.
Who is affected
Oracle's risk matrix lists Oracle E-Business Suite versions 12.2.3 to 12.2.15 for this flaw. The component is Core in Oracle Application Object Library, reached over HTTP. Oracle says it needs no login.
Internet-facing EBS web tiers, where the servlet answers requests from outside, are the most direct exposure. Internal EBS systems are also at risk if an attacker can reach them from another host or network segment.
The fix is in the Oracle October 2026 Critical Patch Update. The advisory points to My Oracle Support note KA923 for the EBS patches. Oracle also tells customers to apply the update to the Database and Fusion Middleware parts of EBS.
Timeline
- 24 Jul 2026
Horizon3.ai says it disclosed the flaw to Oracle.
- 20 Oct 2026
Oracle releases its October 2026 Critical Patch Update with the fix, and lists the flaw as unauthenticated over HTTP with CVSS 9.8. The NVD record is published at 22:18 UTC. Horizon3.ai publishes its advisory and posts about the flaw on X, with indicators of compromise.
- 26 Oct 2026
The first of three public GitHub repositories that carry the CVE id is created. Their READMEs claim a lab, a write-up and a proof of concept archive; we have not verified them.
- 27 Oct 2026
SecurityWeek later reports that a threat intelligence company's EBS decoy systems recorded exploratory exploit attempts this day. CISA's catalog version 2026.10.27 does not list the CVE.
- 28 Oct 2026
SecurityWeek reports the probing. The same day a second honeypot operator says on X that its EBS decoy also captured exploitation attempts.
What to do
-
Find every EBS instance
List production, test and internal systems with their exact version. The flaw covers 12.2.3 to 12.2.15.
-
Apply the October 2026 update
Follow My Oracle Support note KA923 from the Oracle advisory. Apply the update to the Database and Fusion Middleware parts of EBS as well, as Oracle advises.
-
Block the servlet until patched
Horizon3.ai advises removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restricting the web tier to trusted networks. This reduces exposure but does not replace patching.
-
Hunt for the indicators
Horizon3.ai lists unauthenticated POST requests to the servlet that load the Gantt data-server class, SQL reconnaissance such as database version and current user, unexpected files in $APPLPTMP, and the oracle account starting /bin/sh through the Concurrent Manager.
-
Watch for changes
Check the Oracle advisory, the NVD record and the CISA catalog again over the coming days. They may add exploitation details.
Questions
What is CVE-2026-101767?
It is a flaw in the Core component of Oracle Application Object Library in Oracle E-Business Suite. Oracle says an unauthenticated attacker with network access over HTTP can take it over. It scores CVSS 9.8.
Which EBS versions are affected?
Oracle lists Oracle E-Business Suite 12.2.3 through 12.2.15.
Is CVE-2026-101767 exploited?
Oracle does not say so, and CISA's catalog version 2026.10.27 does not list it. SecurityWeek reports that a threat intelligence company's decoy systems recorded exploratory attempts on 27 October 2026.
How do I fix CVE-2026-101767?
Install the Oracle October 2026 Critical Patch Update for E-Business Suite, using My Oracle Support note KA923. Until then, Horizon3.ai advises removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
Is CVE-2026-101809 the same flaw?
No. CVE-2026-101809 is a separate EBS flaw in the Workflow Notification Mailer, scored CVSS 10.0, fixed in the same update.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.