Hackers Start Probing Fresh Oracle EBS Vulnerability

Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite, according to threat intelligence firm Defused, as reported by SecurityWeek.

The flaw, tracked as CVE-2026-101767 with a CVSS score of 9.8, was patched last week in Oracle's October Critical Patch Update. It is described as an SQL injection issue in the Application Object Library product of EBS that remote, unauthenticated attackers could exploit over HTTP. Successful exploitation could let an attacker achieve remote code execution and completely take over the Application Object Library.

Defused said the first exploitation attempts were observed on October 27. "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27," the company said on X. The report describes these as exploratory probes recorded by decoys, not confirmed compromises of production systems.

The defect was discovered and reported by Horizon3.ai, and there have been no other reports of in-the-wild exploitation.

Oracle EBS has drawn repeated attention. In June, Defused warned of attacks exploiting CVE-2026-46817, a critical issue in the File Transmissions component of the Payments product. Last year, the Cl0p ransomware and extortion group exploited zero-day bugs in Oracle's enterprise management software to access stored data.

What defenders should do

• Treat the October CPU as urgent for internet-facing EBS deployments and confirm which Application Object Library versions you run.
• Check EBS and web server logs for unusual HTTP requests or SQL injection patterns, and review the vendor advisory for Oracle's own guidance.
• Limit network exposure of EBS components where your architecture allows it.

The source does not state a patch status beyond the October CPU reference, so verify applicability against Oracle's advisory rather than assuming coverage.

CVE references

CVE-2026-101767

CVE-2026-46817