Skip to content
Hacker Posts

Oracle EBS CVE-2026-101767: unauth SQLi to RCE, decoys already hit

CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in Oracle E-Business Suite that chains to RCE. Patched in the October 2026 CPU; decoys saw probing on Oct 27.

Published 3 min read
cveoracleebsadvisory

Oracle fixed CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite's Application Object Library, in its October 2026 Critical Patch Update. Oracle scores it CVSS 9.8 (vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the Thin Client Framework servlet and, per the researchers who reported it, chains from SQL execution as the APPS database user to operating-system command execution as the application account — a full pre-auth takeover path. If you run EBS, the October CPU is not optional.

What's affected

The bug is in the Thin Client Framework servlet reachable over HTTP without authentication. Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King found it and reported it to Oracle on 24 July 2026. Their account: an unauthenticated attacker injects SQL that runs as the APPS user, then pivots to OS commands as the application account. The data in scope depends on the deployment but can include financial, payroll, HR, and procurement records.

Supported versions Oracle E-Business Suite 12.2.3 through 12.2.15 are affected. The fix ships in the October 2026 CPU; apply the entry for CVE-2026-101767 from Oracle's security-alerts index.

Exploitation status

Threat-intel firm Defused Cyber reported its EBS decoys recorded "exploratory exploits" against the flaw on 27 October, per The Hacker News — probing, not yet confirmed mass exploitation. The flaw is not in CISA's KEV catalog as of 28 October. With a 9.8 pre-auth SQLi-to-RCE now public and decoys lighting up within a day of the CPU, treat the window as short.

Action checklist

  1. Apply the October 2026 Critical Patch Update to every EBS instance now; it carries the fix for CVE-2026-101767.
  2. If any EBS front end is internet-facing, restrict it to the admin network until the CPU is staged — this is a pre-auth path.
  3. Hunt web logs for anomalous requests to Thin Client Framework servlet endpoints and for unexpected database or OS activity under the APPS/application accounts.
  4. Rotate APPS credentials and review service-account activity if you cannot confirm the instance was patched before 27 October.

Context

This is the third 9.8-rated EBS flaw to draw active interest this year. CVE-2025-61882 was weaponized by the Cl0p extortion crew against EBS Payments; CVE-2026-46817 saw in-the-wild file-read exploitation of the Payments module before any PoC existed. EBS keeps proving that a single internet-reachable servlet in a finance stack is worth a zero-day — the pattern holds, and so does the fix: patch on the CPU cadence, and do not expose EBS to the internet.

Related stories