Oracle EBS CVE-2026-101767: Unauthenticated SQLi to RCE

What to do

1. Find every EBS instance and its release: SELECT release_name FROM apps.fnd_product_groups; and note which web tiers are reachable from the internet or partner networks.
2. Apply the October 2026 Critical Patch Update for E-Business Suite, using the patch list in My Oracle Support note KA923, starting with internet-facing instances.
3. Until patched, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist; Horizon3 notes the default URL firewall allows it.
4. Restrict the EBS web tier to trusted networks or put it behind a VPN or authenticating reverse proxy.
5. If an unpatched instance was reachable after October 20, run the detection checks below and treat any hit as a breach of the APPS schema.

How to check if you are affected or compromised

• Search web tier access logs for unauthenticated POST requests to /OA_HTML/AppsTCFServer, especially requests that instantiate oracle.apps.jtf.gantt.server.GanttDataServer.
• In database audit logs, look for reconnaissance queries (database version, current user, directory objects) as APPS shortly after such web requests.
• Check $APPLPTMP for files you cannot account for.
• Look for the oracle OS account spawning /bin/sh through the Concurrent Manager.

What happened#

Oracle's October 2026 Critical Patch Update came out on October 20. It includes CVE-2026-101767, a CVSS 3.1 9.8 flaw in the Core component of Oracle Application Object Library, the foundation layer of E-Business Suite. Oracle's risk matrix lists it as remotely exploitable over HTTP with no authentication on supported releases 12.2.3 through 12.2.15. The CVE record says a successful attack "can result in takeover of Oracle Application Object Library." Oracle credits three Horizon3.ai researchers with the report.

Horizon3.ai's advisory gives the details Oracle leaves out. The bug is an unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer). Horizon3 classes it as CWE-89 plus CWE-306, missing authentication for a critical function. An attacker can "execute SQL as the APPS database user, then run operating system commands as the EBS application account." Horizon3 also notes that the default EBS URL firewall configuration lets this endpoint through. Horizon3 reported the flaw to Oracle on July 24.

On the morning of October 27, threat intelligence firm Defused reported "exploratory" exploit attempts against CVE-2026-101767 on its EBS honeypots, the first public report of activity in the wild. As Cyber Security News notes, honeypot probes do not prove that any real customer system has been breached. CISA has not added the CVE to KEV as of October 28.

Who is affected#

Any organization on Oracle E-Business Suite 12.2.3 through 12.2.15 that has not applied the October 2026 CPU. Oracle documents patch applicability in My Oracle Support note KA923. Real exposure depends on who can reach the EBS web tier. That means instances published to the internet for remote staff, suppliers (iSupplier, iProcurement), job applicants (iRecruitment) or customers, plus internal instances that a phished laptop or a partner VPN can reach.

The same CPU carries 194 E-Business Suite fixes, 31 of them remotely exploitable without authentication. One is CVE-2026-101809 in the Workflow Notification Mailer, rated 10.0. Applying the full EBS CPU covers all of them.

Do you really need to act?#

If your EBS web tier is reachable from untrusted networks, yes, today. The bug needs no credentials and no user interaction, and its impact is the APPS schema, which can read and change every financial, payroll, HR and procurement record in the suite. It sits on an endpoint the default URL firewall allows. EBS is also a proven target: the Cl0p gang used an earlier EBS zero-day, CVE-2025-61882. When probing starts one week after a patch, it often means someone has already diffed the fix.

Some honest limits apply. There is no public proof-of-concept as of October 28. Defused calls the traffic exploratory, and no confirmed victim has been named. Code execution runs as the EBS application account, not root. For an EBS instance reachable only from a well-segmented internal network, patching on a normal emergency-CPU schedule this week is defensible. Do block the servlet in the meantime.

What to do now#

1. Inventory every EBS environment and its release: SELECT release_name FROM apps.fnd_product_groups;. Note which web tiers are reachable from outside, including DMZ nodes used for external modules.
2. Apply the October 2026 CPU for E-Business Suite, using the patch list in My Oracle Support note KA923. Patch internet-facing and DMZ instances first, then clones and non-production copies that hold real data.
3. Until patched, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist (url_fw.conf) on external web tiers. Confirm that the servlet now returns an error from outside.
4. Restrict the web tier to trusted networks, or put it behind a VPN or an authenticating reverse proxy. Horizon3 points out that this reduces exposure but does not replace patching.
5. If an unpatched instance was reachable after October 20, run the checks below. Treat any hit as a compromise of APPS: rotate the APPS and SYSADMIN passwords and the database credentials, and review recent changes to suppliers, bank accounts and payments.

How to tell if you were hit#

Horizon3 publishes these indicators:

• Unauthenticated POST requests to /OA_HTML/AppsTCFServer in Oracle HTTP Server or load balancer logs, especially requests that instantiate oracle.apps.jtf.gantt.server.GanttDataServer.
• Database activity as APPS shortly after those requests, especially reconnaissance such as queries for the database version, the current user and directory objects.
• Unexpected files in $APPLPTMP.
• The oracle OS account spawning /bin/sh through the Concurrent Manager.

Defused says it has fuller indicators but has not published them. Check your logs back to at least October 20, and further if the instance has been exposed for a long time. Horizon3 found the bug as a zero-day in July.

Timeline#

• Jul 24, 2026 — Horizon3.ai reports the zero-day to Oracle.
• Oct 20, 2026 — Oracle's October 2026 CPU fixes CVE-2026-101767; the CVE record is published.
• Oct 27, 2026 — Defused reports exploratory exploit attempts on its EBS honeypots.
• Oct 28, 2026 — No KEV listing, public PoC or confirmed victim as of this writing.

Vulnerability records

• CVE-2026-101767 · Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Oracle — Critical Patch Update Advisory, October 2026 oracle.com
2. CVE record — CVE-2026-101767 cve.org
3. Horizon3.ai — CVE-2026-101767: Oracle EBS TCF SQL injection and RCE horizon3.ai
4. Cyber Security News — Hackers actively exploiting new Oracle EBS RCE vulnerability cybersecuritynews.com

Coverage and analysis

1. Defused — Exploratory exploit attempts against CVE-2026-101767 on EBS honeypots (X post) x.com