cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Oracle E-Business Suite RCE Flaw Sees Reported Probing After Patch

· Original article ↗

Summary

Defused Cyber says its decoys recorded exploratory exploits against patched CVE-2026-101767, an unauthenticated Oracle E-Business Suite flaw that can lead from SQL injection to remote code execution.

Key points

  • Defused Cyber reported that its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on October 27; this is evidence of probing, not confirmation of a successful victim compromise.
  • The CVSS 9.8 flaw affects the Thin Client Framework servlet at /OA_HTML/AppsTCFServer and can be exploited by an unauthenticated attacker with network access.
  • A crafted request can execute SQL as the APPS database user and potentially run operating-system commands as the EBS application account.
  • Successful exploitation could allow reading or modifying application data and executing commands on the application host; potentially accessible records depend on deployment and account permissions.
  • Oracle patched the vulnerability in its Critical Patch Update last week. Users are advised to update; the article does not provide details of the referenced workarounds or indicators of compromise.
  • Horizon3.ai credited Brandon Peterson, Jimi Sebree, and Noah King with discovering and reporting the flaw to Oracle on July 24, 2026.

Article Details

Vulnerability Types
  • Improper authentication
  • SQL injection leading to remote code execution
Severity
Critical (CVSS 9.8)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1059 · Command and Scripting InterpreterThe exploit chain can run operating system commands on the host as the EBS application account.T1190 · Exploit Public-Facing ApplicationExploratory exploits were recorded against the vulnerable Oracle E-Business Suite Thin Client Framework servlet.

CVE

CVE-2025-61882in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come under active exploitation, with the former leveragedCVE-2026-101767The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part ofCVE-2026-46817target for attackers. Over the past year, two critical flaws in the same product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p

People

Brandon PetersonCredited with discovering and reporting CVE-2026-101767 to Oracle.Jimi SebreeCredited with discovering and reporting CVE-2026-101767 to Oracle.Noah KingCredited with discovering and reporting CVE-2026-101767 to Oracle.

Threat Actors

Cl0pThe article says the Cl0p ransomware and extortion crew leveraged CVE-2025-61882.

Vendors

OracleThreat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.

Products

Oracle E-Business SuiteThreat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.

Related Articles