Attackers have started probing the Internet for Oracle E-Business Suite (EBS) systems that have not applied the October patch for CVE-2026-101767, BleepingComputer reports. The flaw sits in the Application Object Library, a core EBS component. Oracle rates it 9.8 out of 10 in its October 2026 Critical Patch Update: it can be exploited over HTTP with no login and low complexity, and can lead to a full takeover of the system.
Threat-intelligence firm Defused said its EBS decoy systems recorded exploratory exploit attempts against the flaw on the morning of 27 October. Defused described the bug as an unauthenticated SQL injection in the EBS Thin Client Framework servlet that chains to remote code execution. Oracle released the fix on 20 October and, as BleepingComputer notes, has not yet marked the flaw as exploited in the wild. Shadowserver tracks more than 670 Internet-exposed EBS instances, most with US addresses, although it does not say how many are honeypots or already patched. The Oracle advisory credits Brandon Peterson of Horizon3.ai for the report.
EBS has been a repeat target: BleepingComputer recalls the Clop group’s exploitation of another EBS flaw, CVE-2025-61882, against high-profile victims starting in August 2025.
How to check if you’re affected
Affected versions are Oracle E-Business Suite 12.2.3 through 12.2.15, the range Oracle lists for CVE-2026-101767 in the October 2026 Critical Patch Update. Oracle’s advisory does not list earlier releases for this flaw, and Oracle urges customers to stay on supported versions.
- Confirm that the October 2026 Critical Patch Update, released on 20 October, has been applied to every EBS instance, including test and staging systems that are reachable from the Internet.
- Find out whether any EBS web tier is exposed to the Internet. Oracle’s message to customers is to patch without delay, and Shadowserver’s count shows many instances are still reachable.
- Because exploit attempts began within a week of the patch, treat unpatched Internet-facing systems as priority and review web and application logs from 27 October onward for unusual requests to the Thin Client Framework servlet. This log-review step is our suggestion, not Oracle’s or Defused’s.