Attackers Begin Scanning for Oracle E-Business Suite Flaw CVE-2026-101767
Threat intelligence firm Defused recorded exploratory attacks against the critical bug days after Oracle's October 20 patch; Oracle has not tagged it as exploited.
Attackers have started probing the internet for Oracle E-Business Suite (EBS) systems that are unpatched against CVE-2026-101767, BleepingComputer reported on October 28.
The vulnerability
The critical flaw sits in the EBS Application Object Library and lets unauthenticated attackers with HTTP network access take over vulnerable systems in low-complexity attacks. Oracle fixed it in its October 2026 Critical Security Patch Update, released October 20. Oracle has not yet marked the bug as exploited in the wild and urged customers to stay on supported versions and patch without delay.
Scanning activity
Threat intelligence firm Defused said on October 27 that its EBS decoys recorded exploratory attacks. It described the bug as "an unauthenticated SQL injection in EBS's Thin Client Framework servlet" that chains to remote code execution.
Shadowserver tracks more than 670 internet-exposed EBS instances, mostly with US IP addresses. It does not say how many are honeypots or already patched.
Background
- The Clop group has exploited a separate EBS flaw, CVE-2025-61882, in zero-day attacks since early August 2025. Victims include Logitech, GlobalLogic, the Washington Post, Harvard University and Dartmouth College.
- In June 2026 Oracle issued emergency mitigations for a PeopleSoft zero-day, CVE-2026-35273, which the ShinyHunters gang exploited between May 27 and June 9.
- Since November 2021, CISA has added 46 Oracle bugs to its Known Exploited Vulnerabilities catalog, 13 of which were also used in ransomware attacks.
