CriticalZero-DayCVE-2026-101767
Hackers Actively Exploiting New Oracle EBS RCE Vulnerability
Cyber Security News·Source published ·1 min read
What happened?
Hackers have begun testing a critical Oracle E-Business Suite vulnerability that can let them run commands without logging in. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026. However, these observations do not confirm successful attacks against customer systems, and Oracle had already released a patch before the activity was detected. Tracked as CVE-2026-101767, the flaw carries a critical CVSS score of 9.8. Horizon3.ai discovered the issue and reported it to Oracle on July 24.
Key details
- Hackers tested exploit code against Oracle EBS decoys on Oct 27 2026
- CVE-2026-101767 is an unauthenticated SQL injection in the Thin Client Framework servlet
- The flaw affects Oracle EBS versions 12.2.3 through 12.2.15 in the Core component
- Initial reports called it a zero-day but it was already publicly disclosed and patched when exploits were observed
What to look for
- Unauthenticated POST requests invoking GanttDataServer followed by database queries
- Unexpected files in $APPLPTMP directory
- Oracle account launching /bin/sh through Concurrent Manager
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.