Oracle E-Business Suite flaw draws exploit attempts, Defused says

Defused, which runs decoy servers to catch attacks, said its Oracle E-Business Suite decoys recorded exploratory exploit attempts on Oct 27 against CVE-2026-101767. Horizon3, which found the flaw, says it’s a SQL injection in EBS’s Thin Client Framework servlet that needs no login and chains to running commands on the server. Oracle fixed it in its October 2026 Critical Patch Update, released Oct 20.

Horizon3 scores the flaw 9.8 and says it affects the Oracle Application Object Library in EBS 12.2.3 through 12.2.15. The vulnerable servlet, /OA_HTML/AppsTCFServer, is allowed through the default EBS URL firewall. An attacker can run SQL as the APPS database user and commands as the EBS application account, which can expose financial, payroll, HR and procurement records, Horizon3 says.

Internet-facing EBS web tiers are the most exposed, Horizon3 says. Internal deployments are at risk too if an attacker can reach the servlet from a compromised system or another reachable network segment. Oracle’s October update credits three Horizon3 researchers for the flaw.

Defused’s Oct 27 post doesn’t say whether any attempt would have succeeded against a real system, or share the requests its decoys recorded. Horizon3 says it reported the flaw to Oracle on Jul 24.