Source: The Hacker News
Enterprises running Oracle E-Business Suite face a narrow but dangerous window. On 27 October 2026, threat intelligence firm Defused Cyber reported that its decoys had recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework (TCF) servlet that can be chained to remote code execution. That was only days after Oracle shipped the fix in its October 2026 Critical Patch Update, which suggests attackers have already reverse engineered the patch and are scanning for unpatched instances.
What the vulnerability allows
Researchers Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai, who reported the flaw to Oracle on 24 July 2026, describe how a crafted unauthenticated request to the TCF servlet at /OA_HTML/AppsTCFServer lets an attacker execute SQL as the APPS database user and then run operating system commands as the EBS application account. The vulnerability carries a CVSS score of 9.8 and requires no credentials and no user interaction. Successful exploitation allows an attacker to read or modify application data accessible to APPS, which depending on the deployment may include financial, payroll, HR and procurement records, and to execute commands on the application host. Internet facing deployments are at greatest risk, but Horizon3.ai warns that internal EBS systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.
This is not an isolated case. Over the past year two other critical EBS flaws, CVE-2025-61882 and CVE-2026-46817, both scored 9.8, have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew. Legacy ERP platforms that sit close to the financial core of the business are clearly established targets.
What to do now
Apply the October 2026 Critical Patch Update immediately if you have not already. If immediate patching is not possible, Horizon3.ai recommends removing /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist, restricting access to the EBS web tier to trusted networks, and monitoring the application host and database for signs of compromise. Useful indicators include unauthenticated POST requests to the servlet that instantiate the Gantt data-server class followed by backend database activity, SQL reconnaissance shortly after unauthenticated web requests, and unexpected files in $APPLPTMP or the oracle account spawning /bin/sh via the Concurrent Manager.
If your organisation runs Oracle EBS or other legacy enterprise applications and wants an independent assessment of exposure, patching priorities or detection coverage, contact us for professional advice.