Risk actors are starting to probe for a newly patched vital vulnerability in Oracle E-Enterprise Suite (EBS), in response to menace intelligence agency Defused Cyber.
The vulnerability in query is CVE-2026-101767 (CVSS rating: 9.8) within the Oracle Software Object Library of Oracle E-Enterprise Suite. It was patched by Oracle final week as a part of its Vital Patch Replace.
Safety researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.
“Our Oracle E-Enterprise Suite decoys recorded exploratory exploits in opposition to CVE-2026-101767, an unauthenticated SQL injection in EBS’s Skinny Shopper Framework servlet that chains to distant code execution, this morning, October 27,” Defused Cyber mentioned in an X publish.
In an advisory for the vulnerability, Horizon3.ai described it as an unauthenticated SQL injection vulnerability that could possibly be chained to realize distant code execution.
“The vulnerability permits an attacker with community entry to the affected Skinny Shopper Framework (TCF) servlet to execute SQL because the APPS database consumer, then run working system instructions because the EBS software account,” the cybersecurity firm mentioned.
Particularly, an attacker can subject a crafted request to the susceptible TCF servlet at “/OA_HTML/AppsTCFServer” to run SQL with the privileges of the APPS database consumer and in the end allow system command execution with the privileges of the EBS software account.
Profitable exploitation of CVE-2026-101767 can allow an attacker to learn or modify software information accessible to APPS and execute instructions on the applying host.
“Relying on the deployment, affected information could embody monetary, payroll, HR, and procurement information. Working system entry is ruled by the permissions of the compromised EBS software account,” Horizon3.ai warned.
Whereas internet-facing EBS deployments current essentially the most danger, inside EBS techniques will also be exploited if an attacker can attain the susceptible servlet from a compromised system or one other accessible community phase.
Customers are suggested to replace to the most recent model as quickly as potential. If rapid patching is just not an possibility, the next workarounds will be utilized –
- Take away /OA_HTML/AppsTCFServer, related to oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist.
- Limit entry to the EBS net tier to trusted networks.
- Monitor the EBS software host and database for indicators of compromise.
Horizon3.ai has additionally shared the under indicators of compromise –
- Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer), adopted by backend database exercise.
- SQL reconnaissance shortly after unauthenticated net requests (database model, present consumer, listing objects).
- Surprising recordsdata in $APPLPTMP and the oracle account spawning /bin/sh by way of the Concurrent Supervisor to run OS instructions.
Vulnerabilities in EBS are a sizzling goal for attackers. Over the previous yr, two vital flaws in the identical product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come beneath energetic exploitation, with the previous leveraged by the Cl0p ransomware and extortion crew.
