Attackers Start Probing Oracle E-Business Suite Flaw Just Days After Patch

Threat intelligence firm Defused Cyber reports that attackers have started probing a critical flaw in Oracle E-Business Suite (EBS), only days after Oracle patched it in its Critical Patch Update. The flaw, tracked as CVE-2026-101767, carries a severity score of 9.8 out of 10. Defused Cyber said its decoy EBS systems recorded exploratory exploit attempts on October 27. Researchers at Horizon3.ai found the issue and reported it to Oracle on July 24, 2026.

According to Horizon3.ai, the flaw is an unauthenticated SQL injection in a component called the Thin Client Framework servlet. An attacker with network access could run database commands as the APPS database user, then run operating system commands as the EBS application account. That could allow them to read or change application data and run commands on the host. Depending on the setup, exposed data may include financial, payroll, HR and procurement records.

Internet-facing EBS systems carry the most risk. However, internal systems can also be attacked if someone reaches the vulnerable component from a compromised device or another part of the network. Oracle users are advised to update to the latest version as soon as possible. The source also mentions workarounds for those who cannot patch immediately, and indicators of compromise shared by Horizon3.ai, but the details were not included in the portion we reviewed.