Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Summary: Threat intelligence firm Defused Cyber reported on October 27 that its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, a CVSS 9.8 improper authentication flaw in the Oracle Application Object Library that Oracle patched the prior week in its Critical Patch Update. Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King, who reported the flaw to Oracle on July 24, 2026, described it as an unauthenticated SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer that lets an attacker run SQL as the APPS database user and then execute operating system commands as the EBS application account.
What you should know: Exploitation can expose financial, payroll, HR, and procurement records, and internal EBS systems are reachable too if an attacker can get to the vulnerable servlet from a compromised host or another network segment. Two prior critical EBS flaws, CVE-2025-61882 and CVE-2026-46817, both CVSS 9.8, already came under active exploitation, the former by the Cl0p ransomware and extortion crew.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-61882 CVE-2026-101767 CVE-2026-46817
Related: Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild Cyber Risks ·
CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability Known Exploited Vulnerabilities · Jul 15, 2026
CVE-2025-61882: Oracle E-Business Suite Unspecified Vulnerability Known Exploited Vulnerabilities · Oct 06, 2025