Attackers have begun scanning the internet for systems left unpatched against a recently disclosed critical Oracle E-Business Suite vulnerability that allows unauthenticated takeover, prompting the software maker to urge customers to apply its October security update without delay.
Tracked as CVE-2026-101767, the flaw sits in the Application Object Library, a core component of Oracle E-Business Suite, and lets unauthenticated attackers with HTTP network access compromise vulnerable systems in low-complexity attacks. Oracle addressed the issue in its October 2026 Critical Security Patch Update, released October 20.
In a warning accompanying the update, Oracle said attackers have succeeded in some cases because customers failed to apply available patches. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches," the company said. "Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
Oracle has not yet listed CVE-2026-101767 as exploited in the wild. But threat intelligence firm Defused said on Tuesday that its decoy systems recorded exploratory attacks against the flaw, which it described as an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution. "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27," Defused warned.
Security watchdog Shadowserver is tracking more than 670 internet-exposed Oracle EBS instances, most with IP addresses in the United States, although it does not indicate how many are honeypots or have already been secured.
Oracle vulnerabilities are a frequent target for attackers because they can give access to enterprise systems used by Fortune 100 corporations, government organizations and healthcare networks. Since November 2021, the US cybersecurity agency CISA has added 46 Oracle bugs to its list of actively exploited vulnerabilities, 13 of which have also been abused in ransomware attacks. Recent examples include the Clop extortion gang's zero-day use of Oracle EBS flaw CVE-2025-61882, which hit Logitech, GlobalLogic, the Washington Post and several US universities, and a ShinyHunters campaign against PeopleSoft that breached Nottingham University, Nissan and the National Association of Insurance Commissioners.
Analysis
Why This Matters
- The flaw allows unauthenticated remote takeover of enterprise systems running Oracle's E-Business Suite, a platform used by large corporations, governments and healthcare networks.
- Public scanning by attackers means the window for organisations to patch before exploitation narrows.
- Oracle's history with this software class shows flaws in it have been used in extortion campaigns and data theft.
Background
Oracle E-Business Suite is a widely deployed enterprise resource planning platform. Oracle issues Critical Security Patch Updates quarterly, and organisations that fall behind on patching have repeatedly been the target of attacks. The US cybersecurity agency CISA tracks Oracle bugs that are actively exploited, and several have been tied to ransomware.
Key Perspectives
- Oracle: says attacks have succeeded where customers failed to apply updates, and strongly recommends customers remain on supported versions and apply patches without delay.
- Defused: says its decoys recorded exploratory exploits of the flaw on October 27, describing it as an unauthenticated SQL injection chaining to remote code execution.
- Shadowserver: tracks more than 670 internet-exposed Oracle EBS instances, mostly with US IP addresses, without indicating how many are honeypots or secured.
What to Watch
- Whether CISA adds CVE-2026-101767 to its list of known exploited vulnerabilities.
- Whether the observed scanning turns into confirmed exploitation against organisations that have not patched.
- Whether Oracle updates its advisory to mark the vulnerability as exploited in the wild.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedAttackers have begun scanning the internet for unpatched Oracle E-Business Suite systems.BleepingComputer: “Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.”
- SupportedDefused recorded exploratory exploits against the critical flaw.BleepingComputer: “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767”
- SupportedOracle urged customers to patch without delay.BleepingComputer: “Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay.”
- SupportedOracle said attackers had succeeded in some cases because targeted customers had failed to apply available patches.BleepingComputer: “In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches,”
- SupportedOracle said customers should remain on actively supported versions and apply security patches without delay.BleepingComputer: “Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay.”
- SupportedThe vulnerability allows unauthenticated attackers with HTTP network access to take over vulnerable systems in low-complexity attacks.BleepingComputer: “this flaw lets unauthenticated threat actors with HTTP network access take over vulnerable systems in low-complexity attacks.”
- Partly supportedThe scanning prompted Oracle to urge customers to apply its October security update.BleepingComputer: “Oracle released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20 and urged customers to patch their systems immediately.”
- SupportedOracle released its October 2026 Critical Security Patch Update on October 20.BleepingComputer: “Oracle released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20”
- SupportedOracle had not yet listed CVE-2026-101767 as exploited in the wild.BleepingComputer: “While Oracle has not yet tagged CVE-2026-101767 as exploited in the wild”
- SupportedDefused said its decoys recorded exploratory exploits against CVE-2026-101767 on the morning of October 27, describing an unauthenticated SQL injection that chains to remote code execution.BleepingComputer: “Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27,”
- SupportedShadowserver was tracking more than 670 internet-exposed Oracle EBS instances, most with IP addresses in the United States, and did not indicate how many were honeypots or already secured.BleepingComputer: “Internet threat watchdog Shadowserver now tracks over 670 Internet-exposed Oracle EBS instances, most of them with IP addresses from the United States. However, Shadowserver doesn't indicate how many are honeypots or have already been secured”
- SupportedSince November 2021, CISA has added 46 Oracle security bugs to its actively exploited list, 13 of which have also been abused in ransomware attacks.BleepingComputer: “Since November 2021, CISA has added 46 Oracle security bugs to its list of actively exploited vulnerabilities, 13 of which have also been abused in ransomware attacks.”