# Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen · pwn.watch

> CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.

Page: https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767 · generated 2026-10-28T11:31:58.937Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Oracle E-Business Suite (Application Object Library)
- Started: 2026-10-20
- CVEs: CVE-2026-101767
- Affected: Oracle E-Business Suite 12.2.3 through 12.2.15
- Fixed in: October 2026 Critical Patch Update patches (see My Oracle Support Note KA923)

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767/feed.xml
- JSON Feed: https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767.json
- This file: https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767/llms.txt

## Updates (newest first)
- 2026-10-27: Defused says its Oracle EBS decoys recorded exploratory exploits against CVE-2026-101767; no other in-the-wild reports yet. (https://x.com/DefusedCyber/status/2115099999973364147)
- 2026-10-20: Oracle's October 2026 Critical Patch Update fixes CVE-2026-101767, reported by Horizon3.ai. (https://www.oracle.com/security-alerts/cpuoct2026.html)

## Fix brief
# Security brief: Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen

Source: https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767 · status: live · severity: critical · updated Oct 28, 2026, 09:26 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.

Severity detail: CVSS 9.8; remote, unauthenticated. Exploratory exploit attempts observed by Defused honeypots on Oct 27; not in CISA KEV.

- Product: Oracle E-Business Suite (Application Object Library)
- CVE / advisory ids: CVE-2026-101767

## Affected versions
- Oracle E-Business Suite 12.2.3 through 12.2.15

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- October 2026 Critical Patch Update patches (see My Oracle Support Note KA923)

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Apply the Oracle E-Business Suite October 2026 CPU patches (My Oracle Support Note KA923). Until patched, remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist and restrict the web tier to trusted networks. Hunt for unauthenticated POSTs to /OA_HTML/AppsTCFServer instantiating oracle.apps.jtf.gantt.server.GanttDataServer, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh via the Concurrent Manager.

## Latest updates
- Oct 27, 2026: Defused says its Oracle EBS decoys recorded exploratory exploits against CVE-2026-101767; no other in-the-wild reports yet.
- Oct 20, 2026: Oracle's October 2026 Critical Patch Update fixes CVE-2026-101767, reported by Horizon3.ai.

## Advisories
- [Oracle Critical Patch Update Advisory - October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html) (Oracle)
- [CVE Record: CVE-2026-101767](https://www.cve.org/CVERecord?id=CVE-2026-101767) (CVE.org)

## Write-ups & news
- [CVE-2026-101767: Oracle EBS SQL Injection RCE](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/)
- [Hackers Start Probing Fresh Oracle EBS Vulnerability](https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/)

---
Machine-readable: https://pwn.watch/i/oracle-ebs-tcf-sqli-rce-cve-2026-101767.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.