VULNpocalypse
CriticalVulnerabilityPatch available

Oracle E-Business Suite CVE-2026-101767: unauthenticated TCF SQL injection to code execution, probed a week after the patch

An unauthenticated SQL injection in EBS 12.2.3 to 12.2.15 leads to OS command execution, and decoys saw exploit attempts. Apply the October 2026 CPU.

Published
Updated
Fixed in
Oracle Critical Patch Update October 2026 (20 October 2026)
Exploitation
Exploit attempts seen on Defused decoys on 27 October 2026 (The Hacker News); no confirmed compromise reported; not in CISA KEV as of 30 October

Live scores

CVE-2026-101767
EPSS
0.006
low predicted chance of attack
VEDAS
0.517
some exploit evidence
On CISA KEV
Not listed
Detection rule
None yet

What happened

Oracle fixed CVE-2026-101767 in its October 2026 Critical Patch Update, released on 20 October 2026. Oracle files it under Oracle Application Object Library (component: Core), rates it CVSS 9.8, remotely exploitable without authentication, and lists EBS 12.2.3 to 12.2.15 as affected (Oracle CPU October 2026; CVE record).

Horizon3.ai found it and reported it to Oracle on 24 July 2026. Oracle credits Brandon Peterson, Jimi Sebree and Noah King. The bug is an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. The default EBS URL firewall allows that servlet. An attacker runs SQL as the APPS database user, then chains to OS commands as the EBS application account. That gives read and write access to whatever APPS can reach, which can include financial, payroll, HR and procurement data (Horizon3.ai).

Probing has started. Defused Cyber’s EBS decoys recorded “exploratory” exploit attempts on the morning of 27 October, one week after the patch (The Hacker News). No confirmed compromise has been reported. CISA’s enrichment of the CVE record, dated 21 October, says exploitation “none” and “automatable: yes” (CVE record). The CVE was not in the KEV catalog as of 30 October (CISA KEV).

The same CPU has 194 new EBS patches, 31 of them for flaws exploitable without authentication. It also includes CVE-2026-101809 in the Workflow Notification Mailer, scored 10.0 (Oracle CPU October 2026).

Am I affected?

You are affected if you run EBS 12.2.3 to 12.2.15 without the October 2026 CPU patches. Check the release from the database:

sql
SELECT release_name FROM apps.fnd_product_groups;

Then check whether the servlet is reachable without logging in. From a host outside your trusted network, a request to https://<ebs-host>/OA_HTML/AppsTCFServer should be blocked. Internet-facing EBS web tiers are the most exposed, but Horizon3 notes internal systems are reachable from any compromised host on a network that can reach the servlet.

Look for signs of exploitation using the indicators Horizon3 published (Horizon3.ai):

  • Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by database activity.
  • SQL reconnaissance soon after such requests: queries for the database version, current user and directory objects.
  • Unexpected files in $APPLPTMP.
  • The oracle account spawning /bin/sh through the Concurrent Manager.
bash
# On each EBS web tier, search the Oracle HTTP Server access logs
grep -rh 'POST /OA_HTML/AppsTCFServer' <ohs-log-directory> | less

# Recent files in $APPLPTMP
ls -lt "$APPLPTMP" | head -50

What to do now

  1. Apply the October 2026 CPU to every EBS 12.2 instance. Use My Oracle Support Note KA923 to find the patches for your release (Oracle CPU October 2026).
  2. If you cannot patch this week, remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist, and restrict the EBS web tier to trusted networks. Horizon3 says these reduce exposure but do not replace the patch (Horizon3.ai).
  3. Hunt back to at least 20 October with the indicators above. Pay most attention to internet-facing web tiers and to process trees where the oracle user starts a shell.
  4. If you find a hit, treat the EBS application tier and the APPS schema as compromised. Scope what APPS can read, including HR and payroll data, and plan for data-theft notification rather than only cleanup.
  5. Do not stop at this CVE. Patch CVE-2026-101809 and the other 30 unauthenticated EBS flaws in the same CPU at the same time.

Why this matters

EBS has been here before. The Cl0p group mass-exploited CVE-2025-61882, another unauthenticated EBS flaw, in 2025 (The Hacker News). CISA’s KEV entry for that bug marks it as used in ransomware campaigns (CISA KEV). The probing of CVE-2026-101767 started seven days after the patch, so the usual quarterly test cycle for an EBS CPU is too slow for this one.

Sources