Attackers Already Scanning for Recently Patched Oracle E-Business Suite Flaw (CVE-2026-101767)

Scope: Oracle E-Business Suite, Application Object Library component (patched in Oracle’s October 2026 Critical Patch Update)

Severity: Red

Threat intelligence firm Defused Cyber confirmed on October 27, 2026, that its Oracle E-Business Suite decoy systems recorded exploratory exploitation attempts against CVE-2026-101767, an unauthenticated SQL injection flaw in EBS’s Thin Client Framework servlet rated 9.8 on CVSS that can be chained into full remote code execution with low attack complexity and no credentials required. Oracle patched the flaw last week as part of its October Critical Patch Update, meaning real-world scanning activity began within days of the fix becoming public, a now-familiar pattern for high-profile Oracle vulnerabilities. Shadowserver currently tracks over 670 internet-exposed Oracle EBS instances, predominantly in the United States, though the figure does not distinguish between honeypots and genuinely unpatched production systems. Oracle E-Business Suite has a troubled recent history on this front: two separate critical flaws in the same product, CVE-2025-61882 and CVE-2026-46817, were both actively exploited over the past year, with the former leveraged by the Cl0p ransomware and extortion crew in a widescale campaign. Organisations running Oracle E-Business Suite must apply the October 2026 Critical Patch Update immediately if this has not already been done, and should treat any internet-facing EBS instance that remains unpatched as an active target rather than a theoretical risk.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.