Attackers start probing a critical Oracle E-Business Suite flaw a week after the patch
October 28, 2026 (Patched October 20; probing from October 27, 2026)
Oracle fixed CVE-2026-101767 on October 20 in its October critical patch update. The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet of E-Business Suite's Application Object Library, and it can lead to remote code execution over ordinary web requests. It is rated 9.8 out of 10 and affects versions 12.2.3 through 12.2.15. Horizon3.ai reported it to Oracle on July 24. On October 27 the threat-intelligence firm Defused recorded exploratory attacks against its decoy systems, the first public sign of attempts. No successful compromise, named attacker or campaign has been reported, and Oracle had not marked the flaw as exploited. Scans count 2,246 internet-facing E-Business Suite web properties (Censys, October 28) and more than 670 exposed instances (Shadowserver), but neither can show which of them are unpatched.
Why it matters
E-Business Suite often holds finance, payroll, HR and purchasing records, so a break-in can reach the most sensitive business data. A patch tells attackers where the flaw is, and probing started within a week of the fix.
What defenders can take from it
- Apply Oracle's October 2026 critical patch update to every internet-facing E-Business Suite instance.
- Until you can patch, remove the /OA_HTML/AppsTCFServer servlet from the URL firewall allowlist and restrict the web tier to trusted networks.
- Review internet-facing instances for compromise using the indicators Horizon3.ai has published.