CVE-2026-101767 is a critical flaw in Oracle E-Business Suite (EBS), rated CVSS 9.8. It lets an unauthenticated attacker send a crafted web request that triggers SQL injection and can be chained into full remote code execution. Oracle patched it in its October 20, 2026 Critical Patch Update, and attackers were already probing for it a week later. If you run EBS, this one needs attention now.
What is CVE-2026-101767?
An unauthenticated SQL injection in Oracle E-Business Suite that can be chained to remote code execution, rated CVSS 9.8.
Which Oracle EBS versions are affected?
Oracle E-Business Suite 12.2.3 through 12.2.15, in the Application Object Library component.
Is it being exploited?
A threat-intelligence firm observed exploratory exploitation attempts against EBS decoys on October 27, 2026, about a week after the patch.
How do I fix it?
Apply Oracle's October 2026 Critical Patch Update to every EBS environment, including production, disaster recovery, and any reachable test or clone.
Who found it?
Researchers at Horizon3.ai discovered the flaw and reported it to Oracle, which credited them in the patch.
Key Takeaways
- CVE-2026-101767 is a CVSS 9.8, unauthenticated SQL injection in Oracle EBS that chains to remote code execution.
- It affects EBS 12.2.3 through 12.2.15, in the Application Object Library component, and was patched in Oracle's October 20, 2026 CPU.
- Attackers began probing for it on October 27, roughly a week after the patch.
- The injected SQL runs as the powerful APPS database user, which is what makes the jump to code execution possible.
- Patch every EBS instance reachable over the network, not just production.
- Watch for the known indicators: requests to the Thin Client Framework servlet followed by database activity and OS commands.
What Happened
Researchers at Horizon3.ai reported the flaw to Oracle in July 2026. Oracle fixed it on October 20 as part of its October 2026 Critical Patch Update, a large release addressing more than a thousand CVEs across its product families. CVE-2026-101767 was one of the headline items: an unauthenticated SQL injection in the Core component of Oracle Application Object Library, exploitable by a remote attacker over HTTP.
A week later, on October 27, threat-intelligence firm Defused reported that its EBS decoy systems had recorded exploratory exploit attempts against the flaw. At the time of writing it wasn't yet in CISA's KEV catalog, but probing within days of a patch is a familiar pattern for internet-facing enterprise software. It's worth noting this is a separate flaw from CVE-2026-101809, a CVSS 10.0 issue in Oracle Workflow fixed in the same update.
What the Flaw Is and Who's Affected
The vulnerability is in the EBS Thin Client Framework (TCF) servlet. An unauthenticated attacker sends a crafted request that reaches the Gantt data-server class, which lets them inject SQL that runs as the APPS database user. From there, Horizon3.ai says the flaw can be chained into operating system command execution under the EBS application account, giving an attacker a path from a single web request to full control of the environment.
Detail | Value |
|---|---|
CVE | CVE-2026-101767 |
CVSS | 9.8 critical (unauthenticated, network, no user interaction) |
Product | Oracle E-Business Suite, Application Object Library (Core) |
Affected versions | 12.2.3 through 12.2.15 |
Fix | October 2026 Critical Patch Update (My Oracle Support Note KA923) |
Attack vector | Unauthenticated HTTP request to the TCF servlet |
Because it's unauthenticated and over HTTP, any EBS instance reachable from the internet, a partner network, or an untrusted segment is at risk, including test and clone environments that are often forgotten.
What to Do Now
- Apply the October 2026 CPU. Patch every EBS 12.2.3 to 12.2.15 environment, including production, disaster recovery, and any test or clone instance reachable over the network.
- Reduce exposure. If an EBS instance doesn't need to be internet-facing, take it off the open internet or put it behind a VPN or allow-list.
- Hunt for the known indicators. Horizon3.ai published signs to look for: unauthenticated POST requests to
/OA_HTML/AppsTCFServerthat instantiate the Gantt data-server class, SQL reconnaissance right after unauthenticated web requests (database version, current user, directory objects), unexpected files in the$APPLPTMPdirectory, and theoracleaccount spawning/bin/shthrough the Concurrent Manager. - Assume breach if you were exposed. Given active probing, treat any internet-facing EBS instance that was unpatched as potentially compromised. Review logs, check for the indicators above, and rotate credentials the APPS account could have reached.
Must Read: JFrog Artifactory Vulnerability: Exploited in Three Days
Why a 20-Year-Old Bug Class Still Wins
SQL injection has been well understood for two decades, yet it keeps producing critical flaws in major enterprise software. The reason is the same every time: user-controlled input reaches a database query without proper separation, and SQL injection remains one of the highest-impact web flaws because the database usually holds everything that matters. When the injected query runs as a privileged account, as it does here with the APPS user, the blast radius grows from "read some data" to "run commands on the server."
Scanners often catch textbook injection, but chained injection-to-RCE paths in complex enterprise apps usually need a person to confirm and follow. That's exactly what an external penetration test is built to do: find the internet-facing weakness, prove how far it reaches, and show which other systems it exposes.
How OraSec Can Help
Patching the October CPU closes this flaw; knowing where your EBS is exposed and whether it was already touched is the next step. OraSec's vulnerability assessment and penetration testing maps your internet-facing Oracle estate, confirms which instances run affected versions, verifies the patch held, and tests how far an injection could reach into the database and the host. If an EBS instance was exposed before you patched, we can help check for the published indicators of compromise. The team's own research has produced published CVEs (CVE-2025-50847 through CVE-2025-50850).
Conclusion
CVE-2026-101767 turns a single unauthenticated request into database access and, chained, into code execution on the server, and attackers started probing for it within a week of the patch. If you run Oracle E-Business Suite 12.2.3 to 12.2.15, apply the October 2026 Critical Patch Update now, cut unnecessary internet exposure, and hunt for the published indicators. Where an instance was exposed, treat it as potentially compromised until you've checked.
Frequently Asked Questions
Which Oracle EBS versions does CVE-2026-101767 affect?
Oracle E-Business Suite 12.2.3 through 12.2.15, in the Application Object Library (Core) component. The fix is in the October 2026 Critical Patch Update.
Is CVE-2026-101767 being actively exploited?
A threat-intelligence firm observed exploratory exploit attempts against EBS decoys on October 27, 2026, about a week after the patch. It wasn't in CISA KEV at the time of writing.
Is this the same as the Oracle Workflow 10.0 flaw?
No. CVE-2026-101809 is a separate CVSS 10.0 flaw in Oracle Workflow, also fixed in the October 2026 CPU. Both are worth patching.
How bad is the impact?
High. The injection runs as the APPS database user and can be chained into operating system command execution, so an attacker can go from one request to full control of the EBS environment.
What indicators should I look for?
Unauthenticated requests to the TCF servlet (/OA_HTML/AppsTCFServer), SQL reconnaissance shortly after, unexpected files in $APPLPTMP, and the oracle account spawning a shell through the Concurrent Manager.
