Skip to content
securitytabs

LiveUpdated

Oracle E-Business Suite flaw patched in October; hackers reported probing for it

A serious flaw in Oracle's E-Business Suite business software could let an outsider with no login take over the system. Oracle has released fixes, and organizations running the software should check that they have applied them.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

Horizon3.ai describes CVE-2026-101767 as a critical unauthenticated SQL injection (a flaw that lets an attacker send database commands without logging in) in Oracle E-Business Suite versions 12.2.3 through 12.2.15. The company says its researchers identified an attack chain that allows remote code execution, meaning running the attacker's own commands, through the TCF servlet. [1]

The flaw was covered in Oracle's October 2026 Critical Patch Update, according to Horizon3.ai and the SANS Internet Storm Center. NVD rates it 9.8 on the CVSS severity scale, and lists the affected product as Oracle Application Object Library. [1][2]

Exploitation

SecurityWeek reported on October 28 that hackers have started probing the vulnerability, and describes it as an unauthenticated SQL injection that can be exploited for remote code execution. The excerpt available does not say who is probing or whether any attack has succeeded. [3]

The flaw is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using. The EPSS estimate of exploitation likelihood was 0.006 on October 27. [3]

What is not yet known

The sources reviewed do not name any victims or attackers, and do not describe the scale of the probing. Oracle's October 2026 security alert is the reference for patch details. [1][3]

Timeline

  1. SecurityWeek reported that hackers had started probing the vulnerability. [3]

  2. SANS Internet Storm Center covered the Oracle E-Business Suite SQL injection fix. [2]

  3. Horizon3.ai published its analysis of the flaw and the October 2026 patches. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Most small organizations do not run Oracle E-Business Suite themselves, but some rely on providers that host it. SecurityWeek reports probing has begun and Horizon3.ai says October patches exist. [3][1]

What to do

  1. Ask your IT provider whether you use Oracle E-Business Suite and whether the October 2026 Oracle patches have been applied. [1]
  2. Watch for notices from your provider or Oracle about the flaw and install updates they supply. [1][3]

Mid-size company

A small IT or security team

What to know

Horizon3.ai says versions 12.2.3 through 12.2.15 are affected and that October 2026 patches and mitigations are available. SecurityWeek reports probing has started. [1][3]

What to do

  1. Confirm whether any E-Business Suite instances in the affected range exist and apply the October 2026 Oracle Critical Patch Update. [1][2]
  2. Review the mitigations described by Horizon3.ai if patching must wait. [1]

Large enterprise

A security operations team

What to know

The flaw is an unauthenticated route to remote code execution in E-Business Suite 12.2.3 to 12.2.15, and SecurityWeek reports early probing. It is not in CISA's KEV catalogue. [1][3]

What to do

  1. Inventory E-Business Suite instances, including internet-facing ones, and apply the October 2026 Critical Patch Update. [1][2]
  2. Review logs for unusual requests to the TCF servlet and treat any sign of probing as a possible incident. [1][3]
  3. Review Horizon3.ai's published mitigations and watch Oracle's security alert for updates. [1]

Sources

  1. [1]Horizon3.ai · Oct 20, 21:23 UTC
    CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Executioncontext
  2. [2]SANS Internet Storm Center StormCast · Oct 21, 02:00 UTC
    SANS Stormcast Wednesday, October 21st, 2026: eMudhra Intermediate CA Certificates Revoked; Critical PHP Security Release; Oracle CPU E-Business Suite SQLi (CVE-2026-101767); FortiSIEM gRPC RCE PoCcontext
  3. [3]SecurityWeek · Oct 28, 09:14 UTC
    Hackers Start Probing Fresh Oracle EBS Vulnerabilitycontext