Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - Help Net Security
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw, and defused posted on X, noting that no public report of the flaw being attempted in the wild had existed before.
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.
Cl0p exploited CVE-2025-61882 as a zero-day in 2025 to steal data from organizations running the suite, and in June, Defused spotted attempts to exploit CVE-2026-46817 , a flaw in the suite’s Oracle Payments module.
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite.
The flaw carries a CVSS score of 9.8 and affects the Application Object Library product in EBS versions 12.2.3 to 12.2.15.
Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host.
The company says an attacker who can reach the vulnerable servlet over the network can run SQL as the APPS database user.
Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the vulnerability and reported it to Oracle on July 24.
Over the past year, two critical flaws in the same product ( CVE-2025-61882 and CVE-2026-46817 , CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew.
What happened
Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.
Cl0p exploited CVE-2025-61882 as a zero-day in 2025 to steal data from organizations running the suite, and in June, Defused spotted attempts to exploit CVE-2026-46817 , a flaw in the suite’s Oracle Payments module.
What changed
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.
Who is affected
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite.
The flaw carries a CVSS score of 9.8 and affects the Application Object Library product in EBS versions 12.2.3 to 12.2.15.
Why it matters
Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host.
The company says an attacker who can reach the vulnerable servlet over the network can run SQL as the APPS database user.
Technical details
Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King found the vulnerability and reported it to Oracle on July 24.
Over the past year, two critical flaws in the same product ( CVE-2025-61882 and CVE-2026-46817 , CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew.
Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay,” the company warned .
Response
The fix arrived with Oracle’s October 2026 patch release, published on October 20, and it was patched by Oracle last week as part of its Critical Patch Update .
What security teams should do
In its October 28 advisory, Censys reported 2,246 web properties running EBS, though its scan data can’t show which of them run an affected release or have installed the October update.
Until patches are in place, Horizon3.ai also advises removing the /OA_HTML/AppsTCFServer servlet from the EBS URL firewall allowlist and restricting the web tier to trusted networks, and has published indicators of compromise that admins can check against.
Attribution
Help Net Security: Exploitation attempts have started against CVE-2026-101767, a recently patched Oracle E-Business Suite (EBS) flaw.
The Hacker News: Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.