Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch Ravie LakshmananOct 28, 2026Vulnerability / Enterprise Security Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update. Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026. "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, October 27," Defused Cyber said in an X post. In an advisory for the vulnerability, Horizon3.ai described it as an unauthenticated SQL injection vulnerability that could be chained to achieve remote code execution. "The vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS application account," the cybersecurity company said. Specifically, an attacker can issue a crafted request to the vulnerable TCF servlet at "/OA_HTML/AppsTCFServer" to run SQL with the privileges of the APPS database user and ultimately enable system command execution with the privileges of the EBS application account. Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host. "Depending on the deployment, affected data may include financial, payroll, HR, and procurement records. Operating system access is governed by the permissions of the compromised EBS application account," Horizon3.ai warned. While internet-facing EBS deployments present the most risk, internal EBS systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment. Users are advised to update to the latest version as soon as possible. If immediate patching is not an option, the following workarounds can be applied - Remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist. Restrict access to the EBS web tier to trusted networks. Monitor the EBS application host and database for signs of compromise. Horizon3.ai has also shared the below indicators of compromise - Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer), followed by backend database activity. SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects). Unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands. Vulnerabilities in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. cyber attacks, enterprise security, Vulnerability, Web Security Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. ROI Calculator: See the Value of IAM Automation Calculate your savings on audits, app onboarding, and discovery. Try it now. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them