Emerging ThreatsMalware & Ransomware

Hackers Probe Oracle EBS Flaw Days After Security Patch

Analyst 207||Source: TheHackerNews
Rows of computer servers and networking equipment in a brightly-lit server room with a single unoccupied workstation in the…

"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, October 27," Defused Cyber said in an X post.

CVE-2026-101767: the flaw and its severity

CVE-2026-101767 is a critical vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (EBS) with a CVSS score of 9.8. Horizon3.ai described it as an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet that can be chained to achieve remote code execution. Oracle patched the vulnerability “last week” as part of its Critical Patch Update, according to reporting on the advisory and related activity.

How exploitation works: the TCF servlet and the APPS account

Horizon3.ai detailed the exploitation chain in technical terms: an attacker with network access to the vulnerable TCF servlet at the path /OA_HTML/AppsTCFServer can send a crafted request to execute SQL with the privileges of the APPS database user. That database access can then be used to run operating-system commands as the EBS application account. Successful exploitation can therefore permit an attacker to read or modify application data available to APPS and to execute commands on the application host, governed by the permissions of the compromised EBS application account.

The advisory spelled out the kinds of data that may be exposed depending on deployment: financial, payroll, HR, and procurement records.

Observed activity: Defused Cyber's decoys and early probes

Defused Cyber reported on X that its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on October 27. The company characterized the activity as exploratory probes rather than confirmed widespread successful intrusions, but the timing—days after Oracle released a patch—highlights the rapid targeting of newly disclosed EBS flaws.

Horizon3.ai indicators of compromise and detection points

Horizon3.ai published concrete indicators of compromise tied to the vulnerability and exploitation attempts. They include:

  • Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.
  • SQL reconnaissance immediately after unauthenticated web requests—queries for database version, current user, and directory objects.
  • Unexpected files appearing in $APPLPTMP and activity where the oracle account spawns /bin/sh via the Concurrent Manager to run OS commands.

The advisory recommends monitoring both the EBS application host and the database for these signs of compromise as part of detection efforts.

Workarounds, patching, and the precedent of previous EBS exploits

Users were advised to update to the latest patched version as soon as possible. Horizon3.ai listed three short-term mitigations for environments where immediate patching is not feasible:

  • Remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist.
  • Restrict access to the EBS web tier to trusted networks.
  • Monitor the EBS application host and database for signs of compromise.

The advisory also placed this vulnerability in the context of recent targeting of EBS: over the past year two other critical flaws in the same product—CVE-2025-61882 and CVE-2026-46817, each with CVSS scores of 9.8—have been actively exploited, and the earlier CVE-2025-61882 was leveraged by the Cl0p ransomware and extortion crew. That history underscores why exploit attempts against newly patched EBS vulnerabilities are noteworthy.

What this means for technologists, affected enterprises, and defenders

Technologists and security teams should prioritize applying Oracle’s Critical Patch Update that addressed CVE-2026-101767 and instrument detection for the IOCs Horizon3.ai published—particularly unauthenticated POSTs to /OA_HTML/AppsTCFServer, SQL reconnaissance activity, and unexpected $APPLPTMP files.

Affected enterprises and procurement leaders running internet-facing EBS deployments must decide between immediate patching and applying the listed mitigations—removing the TCF servlet from allowlists and restricting web-tier access to trusted networks—because internal EBS systems may still be reachable from compromised internal hosts or adjacent network segments.

Defenders should note the rapid cadence: Oracle patched the flaw as part of its Critical Patch Update and, within days, probes were recorded by deception systems. That sequence mirrors earlier incidents where EBS vulnerabilities were exploited in the wild.

Oracle has released a fix; Horizon3.ai and Defused Cyber have published technical indicators showing how probes appear in the wild; and administrators have a short list of mitigations to apply if they cannot patch immediately. With exploratory exploits observed on October 27, the concrete next step for organizations running EBS is immediate action on patching or—where not possible—implementing the published restrictions and monitoring playbook to reduce the chance that reconnaissance matures into full compromise.

Original story

Emerging ThreatsNation-State ActorsRemote Code ExecutionSupply ChainSQL InjectionCritical VulnerabilityCVE-2026-101767Oracle EBSUnauthenticated ExploitsThin Client Framework
Related Intelligence

Continue Reading

Dimly lit government office with desks, filing cabinet, and laptop next to paper files.

Hackers Disrupt US Federal Election Commission's Reporting Systems

A bad actor has attempted to breach the US Federal Election Commission's systems, forcing a temporary shutdown of its public-facing website and filing portal. The outage may disrupt campaign compliance reporting, but shouldn't impact voters' ability to cast their ballots.

Analyst 207
Federal court interior with judge's bench in background and blurred government document in foreground.

US Court Sentences Ransomware Affiliate to 70 Months

A Ukrainian national, Artem Stryzhak, has been sentenced to 70 months in prison for his role in the notorious Nefilim and Hive ransomware operations. This significant sentence marks a major win in the fight against cybercrime, as Stryzhak was a prolific affiliate who helped these operations target and extort wealthy companies.

Analyst 207
Server room with technicians in background, showing signs of urgent concern and equipment issues.

Blast Radius Trumps CVSS in Post-Exploitation Security

In a whirlwind of events, researchers discovered two remote code execution flaws in PHP, which had been hiding in plain sight since 2012, and attackers quickly capitalized on them, with exploitation attempts emerging the same day patches were released. Millions of services are potentially vulnerable, making swift remediation a top priority.

Analyst 207
Technicians inspect equipment in a network operations center with rows of racks and devices.

Vulnerabilities in Critical Network Infrastructure Actively Exploited

In just four weeks, a staggering 2,813 vulnerabilities were uncovered across 18 vendors - including 37 critical advisories and 5 with a maximum severity score of 10.0 - putting critical network infrastructure at risk of active exploitation.

Analyst 207