Hackers Target Patched Oracle EBS Flaw for Remote Code Execution

Hacker activity is targeting a recently patched critical flaw in Oracle E-Business Suite (EBS): CVE-2026-101767, described as an unauthenticated SQL injection in the EBS Thin Client Framework servlet that can chain to remote code execution. Oracle issued a Critical Patch Update in the week prior to 27 October 2026.

Security consultants from Horizon3[.]ai, Brandon Peterson, Jimi Sebree and Noah King, disclosed the flaw to Oracle on 24 July 2026 and say that decoy EBS environments recorded exploratory exploitation attempts against CVE-2026-101767 this morning, with activity observed on 27 October. Horizon3[.]ai characterised the vulnerability as allowing SQL to be executed with the APPS database user, paving the way for OS commands to run under the EBS application account, effectively enabling remote code execution.

Exploitation could enable attackers to read or modify application data accessible to the APPS user and to execute commands on the application host. Impact varies by deployment but may include financial, payroll, HR and procurement records, with OS access governed by the compromised EBS account permissions. Internet-facing EBS deployments pose the greatest risk, though internal networks can be affected if the vulnerable servlet is reachable from a compromised host or other network segment.

The advisory recommends applying the latest patch; as a workaround, organisations should remove the vulnerable /OA_HTML/AppsTCFServer endpoint from the EBS URL firewall allowlist, restrict access to the EBS web tier to trusted networks, and monitor the EBS host and database for signs of compromise. Horizon3[.]ai also supplied indicators of compromise, including unauthenticated POST requests to the AppsTCFServer, followed by SQL reconnaissance and unusual file activity and shell access.

The article notes that prior CVEs in the same product, including CVE-2025-61882 and CVE-2026-46817, have seen active exploitation, highlighting the ongoing risk to Oracle EBS environments.