Summary:
Oracle has patched a critical vulnerability, CVE-2026-101767 (CVSS 9.8), in the Oracle Application Object Library of Oracle E-Business Suite (EBS) as part of its October 2026 Critical Patch Update, and threat actors have begun probing for it. The flaw is an unauthenticated SQL injection in EBS's Thin Client Framework (TCF) servlet that can be chained to remote code execution. Threat intelligence firm Defused Cyber reported exploratory exploitation attempts against its EBS decoys on October 27, 2026, days after the patch was released. Successful exploitation could allow attackers to read or modify application data and execute commands on the application host. Organizations should apply the October 2026 Critical Patch Update immediately.
Technical Description:
CVE-2026-101767 is a critical unauthenticated SQL injection vulnerability in the Thin Client Framework (TCF) servlet of the Oracle Application Object Library in Oracle E-Business Suite, with a CVSS score of 9.8. Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King discovered the flaw and reported it to Oracle on July 24, 2026, and Oracle patched it in its October 2026 Critical Patch Update. The vulnerability allows an attacker with network access to the servlet to execute SQL as the APPS database user, which can then be chained to run operating system commands as the EBS application account.
An attacker can issue a crafted request to the vulnerable servlet at /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, to run SQL with the privileges of the APPS database user. Horizon3.ai identifies unauthenticated POST requests that instantiate the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer), followed by backend database activity, as an indicator of exploitation. Internet-facing EBS deployments present the most risk, although internal systems can also be exploited if an attacker can reach the servlet from a compromised system or another accessible network segment.
The vulnerability affects Oracle E-Business Suite and is fixed in Oracle's October 2026 Critical Patch Update, and users are advised to update as soon as possible. If immediate patching is not possible, Horizon3.ai recommends removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restricting access to the EBS web tier to trusted networks, and monitoring the EBS application host and database for signs of compromise. Defused Cyber recorded exploratory exploits against its EBS decoys on October 27, 2026, indicating that attackers are beginning to probe for the flaw.
| CVE | CVSS | Vulnerability Type | Affected Product | Patch Version |
| CVE-2026-101767 | 9.8 (Critical) | Unauthenticated SQL Injection leading to RCE | Oracle E-Business Suite | Oct 2026 CPU |
Exploitation Demonstration:
•
The attacker identifies an exposed or reachable Oracle E-Business Suite web tier running the TCF servlet at /OA_HTML/AppsTCFServer; no credentials are required.•
The attacker sends a crafted unauthenticated POST request to the servlet that instantiates the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer).•
The request causes SQL to execute with the privileges of the APPS database user, allowing reconnaissance such as database version, current user, and directory objects, and access to application data.•
The attacker chains the SQL execution to run operating system commands as the EBS application account, for example by having the oracle account spawn /bin/sh through the Concurrent Manager.•
The attacker can read or modify financial, payroll, HR, and procurement data and execute commands on the application host, within the permissions of the compromised account.Ease of Exploitation:
The vulnerability has a low barrier to exploitation because it requires only network access to the TCF servlet and no authentication, and the resulting SQL execution can be chained to command execution, which is reflected in its CVSS score of 9.8. Horizon3.ai has published technical details and indicators, and Defused Cyber observed exploratory exploitation attempts against decoy systems days after the patch release. Oracle E-Business Suite has been a frequent target, as two earlier critical flaws, CVE-2025-61882 and CVE-2026-46817, both CVSS 9.8, came under active exploitation, with the former leveraged by the Cl0p ransomware and extortion group.
Conclusion:
CVE-2026-101767 represents a significant security risk to organizations running Oracle E-Business Suite because it allows unauthenticated attackers to run SQL and potentially execute commands on the application host, and exploitation attempts have already begun. Given the history of active exploitation of earlier EBS flaws, organizations should apply the October 2026 Critical Patch Update immediately, restrict access to the servlet and EBS web tier, and hunt for the published indicators of compromise.
Impact:
Successful exploitation could allow attackers to read or modify application data accessible to the APPS database user and execute commands on the application host. Depending on the deployment, affected data may include financial, payroll, HR, and procurement records, and operating system access is governed by the permissions of the compromised EBS application account. This could lead to data theft, unauthorized changes to business records, and disruption of business-critical operations.
IOC and Context Details:
| Topics | Details |
| Tactic Name | Initial Access, Execution |
| Technique Name | Exploit Public-Facing Application; Command and Scripting Interpreter |
| Sub Technique Name | Unix Shell |
| Attack Type | Vulnerability |
| Targeted Applications | Oracle E-Business Suite (Oracle Application Object Library, Thin Client Framework servlet) |
| Region Impacted | Global |
| Industry Impacted | All industries operating Oracle E-Business Suite, including finance, payroll, HR, and procurement functions |
| IOC's | **POST Requests:** /OA_HTML/AppsTCFServer <br> **Java Components:** oracle.apps.jtf.gantt.server.GanttDataServer; oracle.apps.fnd.tcf.SocketServer <br> **Suspicious Files:** Unexpected files in $APPLPTMP <br> **Process Activity:** oracle account spawning /bin/sh via Concurrent Manager |
| CVE | CVE-2026-101767 |
Recommended Actions:
•
Apply Oracle's October 2026 Critical Patch Update to all Oracle E-Business Suite environments immediately, prioritizing internet-facing and externally reachable systems.•
If immediate patching is not possible, remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist.•
Restrict access to the EBS web tier to trusted networks, and use segmentation to limit internal reachability of the servlet.•
Review web server, WAF, and proxy logs for unauthenticated POST requests to /OA_HTML/AppsTCFServer, particularly those instantiating oracle.apps.jtf.gantt.server.GanttDataServer.•
Monitor the EBS database for SQL reconnaissance shortly after unauthenticated web requests, such as database version, current user, and directory object queries, and for unusual APPS user activity.•
Inspect EBS application hosts for unexpected files in $APPLPTMP and for the oracle account spawning /bin/sh via the Concurrent Manager.•
Inventory all EBS instances, including internal, development, and test systems, and verify the patch level of each.•
If compromise is suspected, preserve logs and forensic evidence, isolate affected systems, rotate potentially exposed credentials, and assess exposure of financial, payroll, HR, and procurement data.Reference: