Attackers probe newly patched critical Oracle EBS vulnerability

SecurityWeek reported that threat actors have started probing a critical vulnerability in Oracle E-Business Suite, according to threat intelligence firm Defused. The vulnerability is CVE-2026-101767, an SQL injection issue in the Application Object Library component of EBS, and it has a CVSS score of 9.8. Oracle released the fix for this flaw last week as part of its October Critical Patch Update.

Defused said that its Oracle E-Business Suite decoys recorded the first exploitation attempts against CVE-2026-101767 on the morning of Oct. 27. In a post on X, the company said, "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27". Defused described the attempts as exploratory, and SecurityWeek reported that there have been no other reports regarding in-the-wild exploitation of the flaw.

SecurityWeek reported that unauthenticated attackers can trigger the bug remotely over HTTP. If exploited successfully, the flaw could let an attacker run code remotely and take full control of the Application Object Library. Horizon3.ai discovered and reported the vulnerability, according to SecurityWeek.

SecurityWeek noted that attackers frequently target Oracle EBS vulnerabilities. In June, Defused warned about active exploitation of CVE-2026-46817, a critical flaw in the File Transmissions part of the Payments product in E-Business Suite. Cl0p, a ransomware and extortion group, exploited zero-day bugs in Oracle's enterprise management software last year to access stored data. SecurityWeek also reported that a large-scale EBS hacking campaign may have affected over 100 organizations. Those organizations spanned sectors including energy, consumer goods, manufacturing, media, engineering, finance, heavy industry, entertainment, software, technology, and telecommunications, among others.

Administrators should apply Oracle's October CPU patch to close CVE-2026-101767.