Hackers Start Probing Fresh Oracle EBS Vulnerability
Threat actors have begun probing for a critical vulnerability in Oracle E-Business Suite just one week after it was patched, according to threat intelligence firm Defused.
The exploited vulnerability, tracked as CVE-2026-101767, carries a CVSS score of 9.8 and was addressed in Oracle's October CPU update last week. It represents an SQL injection issue in the Application Object Library product of EBS that could be exploited by remote, unauthenticated attackers over HTTP.
Successful exploitation could allow attackers to achieve remote code execution (RCE) and completely take over the Application Object Library. Defused confirmed that the first exploitation attempts targeting this flaw were observed on October 27.
Initial Exploitation
The security defect was discovered and reported by Horizon3.ai, and there have been no other reports regarding its in-the-wild exploitation beyond the initial probes detected by Defused.
Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27
Historical Context
Oracle EBS vulnerabilities are frequently targeted by threat actors. In June, Defused warned of attacks exploiting CVE-2026-46817, a critical issue in the File Transmissions component of E-Business Suite's Payments product.
Last year, the Cl0p ransomware group exploited zero-day bugs in Oracle's enterprise management software, potentially impacting over 100 organizations across various industries including finance, energy, and technology.
Related
