Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen

Oracle E-Business Suite (Application Object Library)

CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.

Why this severity: CVSS 9.8; remote, unauthenticated. Exploratory exploit attempts observed by Defused honeypots on Oct 27; not in CISA KEV.

Started
Oct 20, 2026
CVE
CVE-2026-101767

Follow this incident

Discuss on X ↗

Affected

  • Oracle E-Business Suite 12.2.3 through 12.2.15

Fixed in

  • October 2026 Critical Patch Update patches (see My Oracle Support Note KA923)

Timeline2

  1. Defused says its Oracle EBS decoys recorded exploratory exploits against CVE-2026-101767; no other in-the-wild reports yet.

  2. Oracle's October 2026 Critical Patch Update fixes CVE-2026-101767, reported by Horizon3.ai.

Advisories2

News & write-ups2
Posts1
Defused
@DefusedCyber

🚨 Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27. The bug was recently disclosed by @Horizon3ai and patched in Oracle's October CPU. No public report exists of this CVE being attempted in the wild. Full IOCs on Defused Radar 👉 t.co/TTnxgi9Hv5

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo