Oracle E-Business Suite (EBS) 12.2.3 to 12.2.15 has a critical vulnerability, CVE-2026-101767, that an attacker with no account can reach over HTTP. Oracle fixed it in its Critical Patch Update of 20 October 2026. On 28 October SecurityWeek reported that a threat intelligence company’s decoy EBS systems recorded exploratory attempts against it on 27 October.
If you run EBS, install the October patches now. Until you have, block the servlet that Horizon3.ai names. The flaw has its own CVE-2026-101767 page.
Last updated: 28 October 2026. We update this page if Oracle or CISA change their notes.
Who Is Exposed to CVE-2026-101767?
Oracle lists the flaw in the Core component of Oracle Application Object Library, in EBS versions 12.2.3 to 12.2.15. Its advisory says an unauthenticated attacker with network access over HTTP can take over the Application Object Library. The CVSS 3.1 score is 9.8. Oracle credits Horizon3.ai with the report.
Horizon3.ai says internet-facing EBS web tiers are the most direct exposure. Internal installations are at risk too if an attacker can reach the servlet from a compromised system or another network segment. It names finance, payroll, HR and procurement records as data that may be reachable, depending on the deployment.
The same Oracle update fixed a second EBS flaw, CVE-2026-101809, in the Workflow Notification Mailer. Oracle scores it 10.0 and also lists it as exploitable without a login. Both affect 12.2.3 to 12.2.15.
Oracle’s October update holds 194 new EBS patches, and 31 of them can be exploited remotely without authentication. Our Oracle October 2026 Critical Patch Update post shows where these two sit among the other Oracle products.
How Far Has the Probing Gone?
Oracle’s advisory does not say the flaw is exploited. SecurityWeek reports that the threat intelligence company said its EBS decoys recorded exploratory exploit attempts on 27 October. On 28 October a second honeypot operator said on X that its EBS decoy had also captured exploitation attempts. Attempts on decoys are not a confirmed breach.
CISA’s Known Exploited Vulnerabilities catalog, version 2026.10.27, does not list CVE-2026-101767. NVD shows the record as awaiting analysis, with Oracle as the source of the score.
- Oracle advisoryYesUnauthenticated, HTTP, CVSS 9.8, fixed in the October 2026 Critical Patch Update20 Oct
- Probing reportedYesSecurityWeek says a threat intelligence company’s decoy systems recorded exploratory attempts; a second honeypot operator said on X it saw attempts too27 to 28 Oct
- CISA KEVNot seenNot listed in catalog version 2026.10.2727 Oct
- GitHub repositoriesYes3 repositories carry the CVE id, the first created on 26 October and the latest on 27 October26 to 27 Oct
- XYes23 distinct public posts matched searches for the two EBS CVE ids and the servlet path; the earliest is the finder’s own post20 to 28 Oct
- Dark web chatYes3 posts in Telegram channels, all from automated CVE feeds21 to 27 Oct
The three GitHub repositories make claims we have not verified. One README describes a Docker lab that reproduces the request flow, one is an advisory-style write-up, and the third offers a zip file labelled proof of concept. We did not run or link them. Treat any such download as untrusted.
The earliest public detail came from the finders. On 20 October the Horizon3.ai attack team posted about the flaw and listed indicators of compromise.
Horizon3.ai’s advisory names the servlet /OA_HTML/AppsTCFServer. It says the default EBS URL firewall configuration lets requests to it through. A crafted request runs SQL as the APPS database user, and the chain can then run operating system commands as the EBS application account. NVD lists the weakness as CWE-287, added by CISA’s enrichment, while Horizon3.ai calls it SQL injection.
Why Do Attackers Keep Coming Back to EBS?
CISA’s catalog already holds other EBS flaws. Among them, CVE-2025-61882 and CVE-2025-61884 were added in October 2025, and CISA marks both as used in ransomware campaigns. CVE-2026-46817, in the Payments product, was added on 15 July 2026 with ransomware use unknown.
In October 2025 Google Threat Intelligence Group reported an extortion campaign against EBS customers by an actor claiming affiliation with the CL0P brand. Our CVE-2025-61882 page covers the first flaw of that wave. That history is why a new unauthenticated EBS flaw deserves a fast patch.
What Should You Do Today?
- Find every EBS instanceList production, test and internal systems with their exact version. The flaw covers 12.2.3 to 12.2.15.
- Apply the October 2026 updateFollow My Oracle Support note KA923. Oracle also tells customers to apply the update to the Database and Fusion Middleware parts of EBS.
- Block the servlet until patchedHorizon3.ai advises removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and limiting the web tier to trusted networks. This reduces exposure but does not replace patching.
- Hunt for the indicatorsHorizon3.ai lists unauthenticated POST requests to the servlet that load the Gantt data-server class, SQL reconnaissance such as database version and current user, unexpected files in $APPLPTMP, and the oracle account starting /bin/sh through the Concurrent Manager.
- Watch for changesCheck Oracle, NVD and the CISA catalog again over the coming days. Oracle or CISA may add exploitation details.
For defenders, this is a textbook case of exploiting a public-facing application through an SQL injection bug. Patch speed matters more than the score.