Skip to content
securitytabs

Updated

Attackers Probe Newly Patched Critical Oracle E-Business Suite Flaw

A serious flaw in Oracle's E-Business Suite, business software used to run finance and operations, can let an outsider take over a server without logging in. Oracle has released a fix, and organizations that run the software should apply it now because probing has begun.

Written by the SecurityTabs AI newsroom from 4 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Horizon3.ai describes CVE-2026-101767 as a critical unauthenticated SQL injection (a way of sending crafted database commands through a web form or service) in Oracle E-Business Suite versions 12.2.3 through 12.2.15. NVD rates it 9.8 on the CVSS severity scale. Oracle's reference for the flaw is its October 2026 security alerts page. [1]

Horizon3 researchers say they identified an attack chain that allows remote code execution (running an attacker's commands on the server) through the TCF servlet. The Hacker News describes the flaw as improper authentication in the Oracle Application Object Library and says Oracle patched it as part of its latest Critical Patch Update. [1][2]

Exploitation

The Hacker News, citing threat intelligence firm Defused Cyber, reports that threat actors have begun probing for the vulnerability days after the patch. SecurityWeek likewise reports that hackers have started probing the flaw. [2][3]

CISA's Known Exploited Vulnerabilities catalogue, its list of flaws attackers are using, does not currently list the flaw. The sources available do not describe successful compromises, victims or who is behind the probing. [2][3]

Patches and mitigations

Horizon3 says its write-up covers affected versions, the October 2026 patches and mitigations. Oracle's fix was released in the October 2026 Critical Patch Update. [1]

Timeline

  1. SecurityWeek and The Hacker News reported that attackers had begun probing for the flaw. [3][2]

  2. SANS Internet Storm Center covered the Oracle E-Business Suite SQL injection flaw in its daily news summary. [4]

  3. Horizon3.ai published an analysis of the flaw and an attack chain leading to remote code execution. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Oracle E-Business Suite is enterprise software, so most small firms use it only through a provider or consultant; the flaw is patched and probing has been reported. [1][2]

What to do

  1. Ask your IT provider or software host whether you use Oracle E-Business Suite and whether the October 2026 Oracle patches are installed. [1]
  2. Ask whether the system is reachable from the internet. [1][2]

Mid-size company

A small IT or security team

What to know

Versions 12.2.3 through 12.2.15 are affected, and attackers have started probing for the flaw days after the patch. [1][2]

What to do

  1. Check which E-Business Suite versions you run and apply the October 2026 Oracle patches. [1]
  2. Review Horizon3's published mitigations if patching must wait. [1]
  3. Watch Oracle's advisory page and further reports of exploitation. [1][2]

Large enterprise

A security operations team

What to know

Defused Cyber reports early probing, and Horizon3 has described a path from the SQL injection to remote code execution; no indicators of compromise are given in the available excerpts. [2][1]

What to do

  1. Inventory E-Business Suite instances, including internet-facing ones, and prioritise the October 2026 patches. [1]
  2. Review web and application logs for unusual requests to the TCF servlet since the patch release. [1][2]
  3. Consult Horizon3's analysis for mitigations and validation guidance. [1]

Sources

  1. [1]Horizon3.ai · Oct 20, 21:23 UTC
    CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Executioncontext
  2. [2]The Hacker News · Oct 28, 12:48 UTC
    Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patchcontext
  3. [3]SecurityWeek · Oct 28, 09:14 UTC
    Hackers Start Probing Fresh Oracle EBS Vulnerabilitycontext
  4. [4]SANS Internet Storm Center StormCast · Oct 21, 02:00 UTC
    SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoCcontext