Defused Cyber reports exploratory probing of Oracle EBS decoys

Defused Cyber said its Oracle E-Business Suite (EBS) decoys recorded exploratory attempts involving CVE-2026-101767 on October 27, 2026, seven days after Oracle released its October Critical Patch Update. The report described probing of decoys, not a customer incident.

Which Oracle EBS releases are affected?

Horizon3.ai identifies EBS versions 12.2.3 through 12.2.15, inclusive, as affected by CVE-2026-101767. The vulnerability is an unauthenticated SQL injection in Oracle Application Object Library, Core, reachable through the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer.

An attacker still needs network access to that servlet over HTTP or HTTPS. The attack does not require credentials or user interaction. Horizon3.ai rates the flaw 9.8, Critical, on the CVSS 3.1 scale. Its technical advisory identifies the endpoint and affected releases.

What could an attacker reach?

Horizon3.ai describes a path from SQL execution as the APPS database user to operating-system commands as the EBS application account. The data and system access at risk depend on the deployment and the permissions of those accounts. Potentially accessible records could include financial, payroll, human resources, and procurement data.

What should EBS administrators prioritize?

Oracle initially released its October 2026 Critical Patch Update on October 20. Horizon3.ai says the update addresses CVE-2026-101767. Oracle’s October CPU advisory covers EBS versions 12.2.3 through 12.2.15. Oracle provides CPU patches for product versions under Premier Support or Extended Support; it says earlier versions may also be affected and recommends upgrading to a supported version.

Until the applicable patch is installed, Horizon3.ai recommends removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, limiting access to the EBS web tier to trusted networks, and monitoring the application host and database. These steps reduce exposure but do not replace the patch. Oracle cautions that workarounds can affect application functionality and should be tested outside production.

What should defenders monitor?

Horizon3.ai lists several indicators for defenders: unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer and are followed by database activity; SQL reconnaissance shortly after unauthenticated web requests; unexpected files in $APPLPTMP; and the oracle account spawning /bin/sh through Concurrent Manager to run operating-system commands. Horizon3.ai says its researchers disclosed the vulnerability to Oracle on July 24, 2026.