Oracle E-Business Suite

Security incidents tagged Oracle E-Business Suite. Newest first.

1 Oracle E-Business Suite incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Patched
Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen
CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite 12.2.3 through 12.2.15, reachable over HTTP through the Thin Client Framework servlet (/OA_HTML/AppsTCFServer). Horizon3.ai, which found it, says it chains to OS command execution as the EBS application account. Oracle fixed it in the October 2026 Critical Patch Update (Oct 20). On Oct 27 Defused said its EBS decoys recorded exploratory exploit attempts. Apply the October CPU patches; until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
Oracle E-Business Suite (Application Object Library)Since Oct 20, 2026updated Oct 28, 2026, 09:26 UTC

Oracle E-Business Suite CVE-2026-101767: unauthenticated SQL injection to RCE, exploitation attempts seen
Defused
@DefusedCyber
🚨 Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27. The bug was recently disclosed by @Horizon3ai and patched in Oracle's October CPU. No public report exists of this CVE being attempted in the wild. Full IOCs on Defused Radar 👉 t.co/TTnxgi9Hv5
Oct 27, 2026view on x