Hackers Scan for Recently Patched Oracle EBS Flaw

Attackers are scanning the internet for systems vulnerable to a recently disclosed flaw in Oracle E-Business Suite (EBS), according to cybersecurity company Defused. The vulnerability, tracked as CVE-2026-101767, affects a core component of EBS’s Application Object Library.

Oracle says the flaw can let unauthenticated attackers with HTTP network access take over vulnerable systems through low-complexity attacks. The company released security updates in its October 2026 Critical Security Patch Update on October 20 and urged customers to install them promptly.

Defused said on October 27 that its Oracle EBS decoys had recorded exploratory attacks against the vulnerability. It described the issue as an unauthenticated SQL injection in the EBS Thin Client Framework servlet that can lead to remote code execution. Oracle has not tagged CVE-2026-101767 as exploited in the wild.

Shadowserver tracks more than 670 internet-exposed Oracle EBS instances, most with US IP addresses. It has not said how many are honeypots or have been secured against the flaw.

Oracle vulnerabilities have drawn attacks before. Since early August 2025, the Clop extortion gang has exploited a separate EBS flaw, CVE-2025-61882, in zero-day attacks. In June 2026, Oracle also issued emergency mitigations for a PeopleSoft Suite zero-day, CVE-2026-35273, which ShinyHunters reportedly exploited from May 27 to June 9.