Oracle has fixed CVE-2026-101767, a vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (EBS), in its October 2026 Critical Patch Update, released on 20 October 2026. Oracle rates it CVSS 3.1 9.8 (Critical). According to Oracle, an unauthenticated attacker with network access over HTTP can exploit it easily, with no user interaction, and a successful attack "can result in takeover of Oracle Application Object Library". Supported EBS versions 12.2.3 through 12.2.15 are affected.
Horizon3.ai, whose researchers Oracle credits with reporting the flaw, describes it as an unauthenticated SQL injection that can be chained to remote code execution. As of 21 October 2026, the flaw is not in CISA's Known Exploited Vulnerabilities (KEV) catalog, and we found no public report of exploitation in the wild. A fix is available now: apply the October 2026 CPU while no exploitation has been reported.
Horizon3.ai notes that, depending on the deployment, the data at risk may include financial, payroll, HR and procurement records. That makes this a vendor-risk issue as well as an internal one: the EBS instance that holds your data may belong to a supplier or service provider.
Technical Information
Oracle lists CVE-2026-101767 in the Oracle E-Business Suite risk matrix of its October 2026 CPU (product: Oracle Application Object Library; component: Core; protocol: HTTP; remotely exploitable without authentication: Yes). The text form of the risk matrix gives the CVSS 3.1 vector as AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with high impact on confidentiality, integrity and availability. Oracle does not publish technical details of the flaw.
What the researchers say: Horizon3.ai says the flaw is an unauthenticated SQL injection in the EBS Thin Client Framework (TCF) servlet. It says an attacker could run SQL as the APPS database user and then run operating system commands as the EBS application account, and that the servlet is allowed through the default EBS URL firewall configuration. Horizon3.ai says internet-facing EBS web tiers are the most directly exposed, and that internal deployments are also at risk if an attacker can reach the servlet from inside the network. These are Horizon3.ai's findings, not Oracle's. Oracle's advisory describes the impact only as takeover of Oracle Application Object Library.
Severity: Oracle, the CVE Numbering Authority (CNA), scores the flaw CVSS 3.1 9.8 (Critical). As of 21 October 2026, NVD lists the record with status "Received" and shows Oracle's 9.8 score. NVD has not published its own assessment. Oracle itself expresses severity through the CVSS score; its CPU text describes the flaw as "Easily exploitable" by an "unauthenticated attacker with network access via HTTP".
A second EBS flaw in the same update: The same EBS risk matrix lists CVE-2026-101809, a separate flaw in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer), affecting the same supported versions 12.2.3 to 12.2.15. Oracle scores it CVSS 3.1 10.0 (scope changed) and says an unauthenticated attacker with network access via HTTP can exploit it, with successful attacks resulting in "takeover of Workflow" (text-form risk matrix). It is fixed by the same October 2026 CPU. Overall, Oracle says 31 of the 194 new EBS security patches in this update address vulnerabilities that "may be remotely exploitable without authentication" (October 2026 CPU).
Exploitation status: Not in CISA KEV as of 21 October 2026. We found no report of in-the-wild exploitation or a public proof of concept from Oracle, CISA, CERT-EU, the UK NCSC, JPCERT/CC or the security press we checked. Oracle's CPU advisory warns that it "continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches".
Why EBS draws attention: EBS has been attacked before. Oracle issued an out-of-cycle Security Alert for CVE-2025-61882 in October 2025. CISA lists that flaw in KEV with known ransomware campaign use. Google Threat Intelligence Group and Mandiant reported that a threat actor claiming affiliation with the CL0P extortion brand exploited EBS customer environments in 2025, possibly via CVE-2025-61882 as a zero-day. Rescana covered that 2025 campaign in earlier posts, for example Envoy Air Data Breach: Clop Ransomware Exploits Oracle E-Business Suite Zero-Day (CVE-2025-61882). More recently, CISA added a different EBS flaw, CVE-2026-46817, to KEV on 15 July 2026 (Rescana coverage). CVE-2026-101767 is a separate flaw, and no source links it to any of that activity.
Timeline (dates in UTC; source in brackets):
- 24 July 2026: Horizon3.ai reports the flaw to Oracle [Horizon3.ai].
- 20 October 2026: Oracle releases the October 2026 Critical Patch Update, which fixes CVE-2026-101767 [Oracle CPU]. The CVE record is published by Oracle [cve.org], and Horizon3.ai publishes its vulnerability summary [Horizon3.ai].
- 21 October 2026: The SANS Internet Storm Center's Stormcast highlights the flaw, noting that Horizon3.ai is teasing details [SANS ISC].
Affected Product Versions
| Product | Component | Affected (supported versions) | Fix |
|---|---|---|---|
| Oracle E-Business Suite: Oracle Application Object Library | Core | 12.2.3 to 12.2.15 | October 2026 Critical Patch Update (patch details in My Oracle Support Note KA923) |
Oracle's matrix covers supported versions only. Oracle says product releases outside Premier Support or Extended Support "are not tested for the presence of vulnerabilities addressed by this Critical Patch Update", but that "it is likely that earlier versions of affected releases are also affected". Oracle also notes that EBS includes Oracle Database and Oracle Fusion Middleware components, and it recommends applying the October 2026 CPU to those components too.
Workaround and Mitigation
- Apply the October 2026 CPU. Patch every EBS 12.2.3 to 12.2.15 environment (Rescana guidance: including production, disaster recovery and any test or clone instance reachable over the network). Oracle's October 2026 CPU points EBS customers to My Oracle Support Note KA923 for the required patches. Oracle also recommends applying the October 2026 CPU to the Oracle Database and Fusion Middleware components of EBS.
- If you can't patch yet, cut exposure. Rescana guidance: keep the EBS web tier off the internet and allow HTTP(S) access only from trusted networks (for example through a VPN or an allowlisted reverse proxy). Horizon3.ai also advises restricting the EBS web tier to trusted networks and removing the affected TCF servlet (/OA_HTML/AppsTCFServer) from the EBS URL firewall allowlist until patches are installed. It notes that these measures reduce exposure but do not replace patching. Oracle has published no workaround specific to this flaw. Its CPU advisory says only, in general terms, that until patches are applied "it may be possible to reduce the risk of successful attack by blocking network protocols required by an attack", that this may break application functionality, and that it should not be "considered a long-term solution".
- Check your logs. Rescana guidance: review EBS web-tier access logs, and database and application-host activity, for unusual unauthenticated requests followed by unexpected database or operating-system activity. Horizon3.ai's published detection guidance is summarised under Indicators of Compromise below.
- Find EBS outside your own estate. Rescana guidance: identify vendors, outsourcers and managed service providers that run EBS 12.2.x for you, or host it on your behalf, and confirm their patch status (see below).
Indicators of Compromise
None published. Oracle, CISA and the CERTs we checked have released no indicators of compromise, and there is no reported in-the-wild exploitation to draw them from. Horizon3.ai lists the following under "Indicators of Compromise". They are behavioural signals published by the researcher for defenders, not indicators taken from observed attacks:
- unauthenticated POST requests to /OA_HTML/AppsTCFServer, followed by backend database activity;
- SQL reconnaissance (database version, current user, directory objects) shortly after unauthenticated web requests;
- unexpected files in $APPLPTMP and the oracle account spawning /bin/sh through the Concurrent Manager.
ATT&CK mapping: none sourced.
Why this matters for vendor risk
If a critical vendor or service provider runs its finance, procurement, payroll or supply chain operations on Oracle E-Business Suite, or runs EBS for you as an outsourcer, this flaw reaches your data even if you don't run EBS yourself. Oracle says an unauthenticated attacker could take over a core EBS component, and EBS has been targeted before. Ask your critical vendors and service providers directly: do you run Oracle E-Business Suite 12.2.x? Have you applied the October 2026 CPU? If not, when will you, and what interim controls are in place, such as keeping EBS off the internet? Then follow up until each one confirms.
What we will update: We will update this post if CISA adds CVE-2026-101767 to KEV, if exploitation or a public proof of concept is reported, if NVD publishes its own score, or if Oracle revises its advisory.
Sources
- Oracle, Critical Patch Update Advisory - October 2026 (Rev 1, 20 October 2026): https://www.oracle.com/security-alerts/cpuoct2026.html
- Oracle, Text Form of Oracle CPU October 2026 Risk Matrices: https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- CVE Record CVE-2026-101767 (cve.org): https://www.cve.org/CVERecord?id=CVE-2026-101767
- NVD, CVE-2026-101767: https://nvd.nist.gov/vuln/detail/CVE-2026-101767
- Horizon3.ai, "CVE-2026-101767: Oracle E-Business Suite TCF SQL Injection and Remote Code Execution" (20 October 2026): https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/
- SANS Internet Storm Center, Stormcast for Wednesday, 21 October 2026: https://isc.sans.edu/podcastdetail/10144
- Oracle, Security Alert Advisory CVE-2025-61882: https://www.oracle.com/security-alerts/alert-cve-2025-61882.html
- CISA Known Exploited Vulnerabilities catalog, CVE-2025-61882: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-61882
- CISA Known Exploited Vulnerabilities catalog, CVE-2026-46817: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46817
- Google Threat Intelligence Group and Mandiant, "Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign" (9 October 2025): https://cloud.google.com/blog/topics/threat-intelligence/oracle-ebusiness-suite-zero-day-exploitation
Forward this to your TPRM owner: If any of your critical vendors or service providers run Oracle E-Business Suite 12.2.x, ask now whether the October 2026 CPU is applied, when it will be if not, and what keeps EBS off the internet until then.
Want to know which of your vendors run exposed Oracle E-Business Suite and whether they patch fast? Book a demo.
