Attackers Probe Newly Patched Oracle EBS Vulnerability

Attackers began probing CVE-2026-101767, a critical vulnerability in Oracle E-Business Suite, on Oct. 27, days after Oracle released a patch. The flaw can allow unauthenticated attackers to execute code remotely and take control of the suite’s Application Object Library.

The vulnerability affects the Application Object Library and results from an SQL injection flaw. Attackers can exploit it remotely over HTTP without logging in. Oracle assigned the vulnerability a CVSS severity score of 9.8.

Defused recorded exploratory exploit attempts against the vulnerability in its Oracle E-Business Suite decoys on Oct. 27. No other reports have confirmed successful exploitation in the wild.

“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27,” Defused wrote in a post on X.

Oracle addressed the vulnerability in its October Critical Patch Update, released last week. Cybersecurity company Horizon3.ai discovered and reported the defect.

In June, Defused reported attacks targeting CVE-2026-46817, a critical vulnerability in the File Transmissions component of Oracle E-Business Suite’s Payments product.

In 2025, the Cl0p ransomware and extortion group exploited zero-day vulnerabilities in Oracle enterprise software to access stored data. The campaign potentially affected more than 100 organizations in industries including finance, manufacturing, energy, telecommunications, technology and media.