Threat Actors Scan for Recently Patched Oracle E-Business Suite Flaw
Summary
Defused reported exploratory exploit attempts against Oracle E-Business Suite CVE-2026-101767, an unauthenticated flaw that can lead to remote code execution. Oracle released patches on October 20; exploitation in the wild is not confirmed.
Key points
- CVE-2026-101767 affects a core component of Oracle E-Business Suite’s Application Object Library and can allow unauthenticated system takeover over HTTP.
- Defused said its EBS decoys recorded exploratory exploit attempts on October 27 involving SQL injection in the Thin Client Framework servlet that chains to remote code execution.
- Oracle released fixes in its October 2026 Critical Security Patch Update and urged customers to apply security patches promptly.
- Oracle has not tagged CVE-2026-101767 as exploited in the wild.
- Shadowserver tracks more than 670 internet-exposed Oracle EBS instances, but its count does not show how many are honeypots or already secured against the flaw.
Article Details
- Vulnerability Types
- SQL injection
- Severity
- Critical
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationDefused reported exploratory attempts against the unauthenticated SQL injection in Oracle EBS's Thin Client Framework servlet, which can chain to remote code execution.T1595.002 · Vulnerability ScanningDefused reported exploratory exploit activity, and attackers were scanning Internet-exposed systems for the Oracle EBS vulnerability.
CVE
CVE-2025-61882For instance, since early August 2025, the Clop extortion gang has exploited another Oracle EBS flaw (CVE-2025-61882) in zero-day attacks targeting high-profile victims like Logitech, GlobalLogic, and the WashingtonCVE-2026-101767Discovered in a core component of EBS's Application Object Library and tracked as CVE-2026-101767, this flaw lets unauthenticated threat actors with HTTP network access take over vulnerable systems in low-complexityCVE-2026-35273More recently, in June, Oracle released emergency mitigations for a critical PeopleSoft Suite zero-day (CVE-2026-35273) that the ShinyHunters extortion gang exploited between May 27 and June 9.
Threat Actors
ClopThe article says the extortion gang exploited Oracle EBS vulnerability CVE-2025-61882 in zero-day attacks beginning in early August 2025.ShinyHuntersThe article says the extortion gang exploited the PeopleSoft Suite zero-day CVE-2026-35273 from May 27 to June 9, gaining unauthenticated remote code execution and stealing data.
Vendors
Products
Oracle E-Business SuiteAttackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.PeopleSoft SuiteMore recently, in June, Oracle released emergency mitigations for a critical PeopleSoft Suite zero-day (CVE-2026-35273) that the ShinyHunters extortion gang exploited between May 27 and June 9.
Countries
Industries
GovernmentAttackers often target Oracle vulnerabilities because they let them breach enterprise systems on the networks of many Fortune 100 corporations, government organizations, and healthcare networks around the world.HealthcareAttackers often target Oracle vulnerabilities because they let them breach enterprise systems on the networks of many Fortune 100 corporations, government organizations, and healthcare networks around the world.