Attackers probed Oracle EBS on October 27

Defused Cyber’s Oracle E-Business Suite decoys logged exploratory requests against CVE-2026-101767 on the morning of October 27, within days of Oracle shipping a fix in its latest Critical Patch Update. The flaw scores 9.8 and lives in the Oracle Application Object Library. Horizon3.ai, whose researchers Brandon Peterson, Jimi Sebree, and Noah King reported it to Oracle on July 24, 2026, calls it an unauthenticated SQL injection that chains to remote code execution.

The target is the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. An attacker who can reach that servlet over the network sends a crafted request and executes SQL as the APPS database user, the account EBS uses for its own application schema. That foothold chains onward to operating system commands running as the EBS application account. No credentials are needed at any step.

APPS is not a low-privilege account. It can read and modify the application data the suite runs on, which Horizon3.ai notes may include financial, payroll, HR, and procurement records depending on the deployment. What an attacker can do at the OS layer depends on the permissions of the compromised EBS application account, but code execution on the application host is the baseline outcome.

Internet-facing EBS installs are the obvious exposure. Horizon3.ai is clear that internal deployments are reachable too: if an attacker lands on a compromised host or an adjacent network segment that can hit the servlet, the same unauthenticated path works. Network position, not internet exposure, is what gates this.

EBS has been a repeat target. Over the past year two other critical flaws in the product, CVE-2025-61882 and CVE-2026-46817, both 9.8, came under active exploitation, with the former used by the Cl0p ransomware and extortion crew.

If you can’t patch immediately

Update to the fixed version first. When that has to wait, the published workarounds are narrow and worth applying. Drop /OA_HTML/AppsTCFServer, backed by oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist. Restrict the EBS web tier to trusted networks. Monitor the application host and database for signs of compromise.

Horizon3.ai published concrete indicators for that monitoring. Look for unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity. Expect SQL reconnaissance shortly after those unauthenticated web requests: queries for the database version, the current user, and directory objects. On the host, unexpected files in $APPLPTMP and the oracle account spawning /bin/sh through the Concurrent Manager to run OS commands indicate the chain completed.