Attackers Probe Critical Oracle EBS SQL Injection Flaw That Can Lead to RCE

Defused observed exploratory exploitation attempts against its Oracle E-Business Suite (EBS) decoys on October 27 targeting CVE-2026-101767, a critical unauthenticated SQL injection vulnerability rated CVSS 9.8. Discovered and reported by Horizon3.ai, the flaw affects the Thin Client Framework servlet in Oracle Application Object Library’s Core component in EBS versions 12.2.3 through 12.2.15. Remote attackers can exploit it over HTTP to execute database commands as the privileged APPS user and potentially chain the vulnerability into operating system command execution with the EBS application account’s permissions, exposing sensitive business records to theft or alteration.

Oracle patched the vulnerability in its October 20 Critical Patch Update. Although some reporting describes active exploitation, the documented activity consists of exploratory attempts against decoys; the references do not establish successful production compromises, data theft, or a widespread campaign. Organizations running affected EBS versions should prioritize the relevant patches, restrict access to the vulnerable servlet, and investigate suspicious HTTP requests and unusual database or application-account activity.