Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen ยท updates https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767 CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist. en Tue, 27 Oct 2026 00:00:00 GMT Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen: Defused says its Oracle EBS decoys recorded exploratory exploits against CVE-2026-101767; no other in-the-wild reports yet. https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767 https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767#2026-10-27-528163dd Tue, 27 Oct 2026 00:00:00 GMT critical <p><a href="https://x.com/DefusedCyber/status/2115099999973364147">Source</a></p> Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen: Oracle's October 2026 Critical Patch Update fixes CVE-2026-101767, reported by Horizon3.ai. https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767 https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767#2026-10-20-612b79ff Tue, 20 Oct 2026 00:00:00 GMT critical <p><a href="https://www.oracle.com/security-alerts/cpuoct2026.html">Source</a></p>