Attackers Begin Probing Unauthenticated Oracle E-Business Suite Flaw CVE-2026-101767
Organisations running internet-exposed Oracle EBS instances face a remotely exploitable critical flaw that is now being probed, so the October patch matters now.
Threat intelligence firm Defused says attackers have started probing for CVE-2026-101767, a critical flaw in Oracle E-Business Suite patched in last week's October Critical Patch Update. The SQL injection bug, scored 9.8 on CVSS, can be exploited remotely over HTTP without logging in and can lead to remote code execution and full control of the Application Object Library. Defused recorded exploratory attempts on October 27 through its decoy systems, though no confirmed in-the-wild exploitation has been reported beyond that. Shadowserver counts more than 670 internet-exposed EBS instances, mostly in the United States, and Oracle urges customers to patch without delay. The flaw was found by Horizon3.ai, and earlier Oracle EBS bugs have been used in large extortion campaigns, which raises the stakes for organisations running unpatched systems.
Why it matters
The flaw can be reached over HTTP without logging in and can lead to remote code execution, so anyone running an exposed Oracle E-Business Suite instance is in the path of a bug that attackers have started testing. Defused has recorded exploratory attempts but no confirmed exploitation beyond that, and Shadowserver counts more than 670 exposed instances, most in the United States. Earlier Oracle EBS bugs have been used in large extortion campaigns, which is why the fix Oracle shipped on October 20 is the thing to act on.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.