Hackers Probe Oracle EBS Flaw After October Patch

Threat intelligence firm Defused reports that hackers have begun probing a freshly patched Oracle E-Business Suite (EBS) vulnerability, tracked as CVE-2026-101767, which carries a CVSS score of 9.8. The flaw is described as an unauthenticated SQL injection in the Application Object Library component of EBS that can be exploited remotely over HTTP, potentially allowing remote code execution and complete takeover of the Application Object Library. Oracle patched the issue in its October CPU released last week.

Defused noted that the first exploitation attempts targeting CVE-2026-101767 were observed on 27 October, with their EBS decoys recording exploratory exploits on the morning of that date. The vulnerability was discovered and reported by Horizon3[.]ai, and at the time of reporting there were no other in-the-wild exploitation reports beyond the observed probes.

Oracle EBS has historically been a frequent target for attackers; the article also cites previous related activity, including June attacks exploiting CVE-2026-46817 in the File Transmissions component of E-Business Suite’s Payments product and a broader, earlier campaign involving EBS that affected numerous organisations across multiple sectors.

The piece notes that exploitation attempts are already underway against the patched vulnerability and situates CVE-2026-101767 within ongoing EBS-targeted threats. It attributes the initial discovery to Horizon3[.]ai and the subsequent reporting to Defused, with the exploitation activity described as exploratory rather than confirmed widespread in the wild. No additional actionable remediation details are provided in the article beyond the Oracle patch and the observed probing activity.