Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.

8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update . Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.

ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.

"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, October 27," Defused Cyber said in an X post. In an advisory for the vulnerability, Horizon3.

ai described it as an unauthenticated SQL injection vulnerability that could be chained to achieve remote code execution.

"The vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS application account," the cybersecurity company said .

Specifically, an attacker can issue a crafted request to the vulnerable TCF servlet at "/OA_HTML/AppsTCFServer" to run SQL with the privileges of the APPS database user and ultimately enable system command execution with the privileges of the EBS application account.

Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host. "Depending on the deployment, affected data may include financial, payroll, HR, and procurement records.

Operating system access is governed by the permissions of the compromised EBS application account," Horizon3. ai warned.

While internet-facing EBS deployments present the most risk, internal EBS systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment. Users are advised to update to the latest version as soon as possible.

If immediate patching is not an option, the following workarounds can be applied - Horizon3. ai has also shared the below indicators of compromise - Vulnerabilities in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product ( CVE-2025-61882 and CVE-2026-46817 , CVSS scores: 9.

8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew. Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities.

Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar.