Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767)
ID: d4ec5d6f-b37a-534b-921c-044edd3f9364
STIX ID: report--d4ec5d6f-b37a-534b-921c-044edd3f9364
Feed Name: Help Net Security
Threat Score
Defused and Horizon3.ai observed exploitation attempts targeting CVE-2026-101767, a critical (CVSS 9.8) unauthenticated SQL injection in Oracle E-Business Suite (AOL product, EBS 12.2.3–12.2.15) that can lead to remote code execution and access to sensitive application data; Oracle issued an October 2026 patch and vendors advise applying fixes, removing the /OA_HTML/AppsTCFServer servlet from allowlists, restricting web-tier access, and checking IOCs for compromise.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.