Defused reported exploratory attempts against its Oracle E-Business Suite (EBS) decoys on October 27, 2026. The observation concerned activity against honeypots, while Oracle’s October security update had already addressed CVE-2026-101767 on October 20.
Defused’s original post described the attempts against its decoys. It was a report of probing in a decoy environment, not a report of a production intrusion.
Which Oracle EBS versions are affected?
Oracle’s October 2026 risk matrix lists Oracle Application Object Library Core in EBS versions 12.2.3–12.2.15 for CVE-2026-101767. Oracle rates the vulnerability CVSS 3.1 9.8 and describes an unauthenticated attacker reaching the system over HTTP. A successful attack can take over Oracle Application Object Library, according to Oracle’s risk matrix.
Horizon3.ai describes the flaw as SQL injection in the Thin Client Framework servlet at /OA_HTML/AppsTCFServer. Its analysis says the vulnerability can let an attacker run SQL as the APPS database user and chain that access to operating-system commands as the EBS application account. This technical description is from Horizon3.ai’s advisory.
Oracle’s October update addresses the flaw
Oracle issued its October 2026 Critical Patch Update on October 20, and the update addresses CVE-2026-101767. Administrators running an affected version should apply the applicable Oracle patch; Oracle’s update provides the vendor’s patch context.
Horizon3.ai recommends removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist until patching is complete, limiting access to the EBS web tier to trusted networks, and monitoring the application host and database. These steps reduce exposure, but Horizon3.ai says they do not replace installing the patch.
For affected EBS systems, prioritize Oracle’s patch; use access restrictions and monitoring as interim safeguards, not substitutes.
