Hackers now scanning systems for recently-patched Oracle flaw

What happened?

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]

Key details

• The flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that chains to remote code execution.
• Oracle released security updates in the October 2026 Critical Security Patch Update on October 20.
• Shadowserver tracks over 670 Internet-exposed Oracle EBS instances.
• The Clop extortion gang has exploited another Oracle EBS flaw since August 2025.
• Oracle has not yet tagged CVE-2026-101767 as exploited in the wild.

Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.