Defused Reports Probing of Patched Oracle EBS Vulnerability
Summary
Defused says its decoys recorded exploratory attempts against Oracle EBS flaw CVE-2026-101767 on October 27. Oracle patched the critical remote SQL injection in its October CPU; no other in-the-wild exploitation reports are cited.
Key points
- CVE-2026-101767 is a critical SQL injection flaw in Oracle E-Business Suite’s Application Object Library, with a CVSS score of 9.8.
- The flaw could let remote, unauthenticated attackers exploit the application over HTTP to achieve remote code execution and take over the Application Object Library.
- Oracle patched the vulnerability in its October Critical Patch Update, released the previous week.
- Defused says its decoys recorded exploratory exploits on October 27; the article cites no other reports of in-the-wild exploitation.
- Horizon3.ai discovered and reported the vulnerability.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- Critical (CVSS 9.8)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Threat Actors
Vendors
Products
Application Object LibraryIt is described as an SQL injection issue in the Application Object Library product of EBS that could be exploited by remote, unauthenticated attackers over HTTP.Oracle E-Business SuiteThreat actors have started probing for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), threat intelligence firm Defused reports.