Attackers have begun searching the Internet for unpatched systems against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.
Discovered in a core component of the EBS Application Object Library and tracked as CVE-2026-101767This flaw allows unauthenticated malicious actors with access to the HTTP network to take control of vulnerable systems in low-complexity attacks.
Oracle has released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20 and urged customers to immediately update their systems.
“In some cases, it has been reported that the attackers were successful because the targeted customers had not applied available Oracle patches,” he added. “Oracle therefore strongly recommends that customers maintain actively supported versions and apply security patches without delay.”
Although Oracle has not yet identified CVE-2026-101767 as being exploited in the wild, threat intelligence firm Defused said Tuesday that it has already spotted malicious actors scanning the Internet for vulnerable systems.
“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework servlet that chains to remote code execution, this morning, October 27.” Defused warned.
Shadowserver, Internet Threat Monitoring Organization, Now tracks over 670 Oracle EBS instances exposed on the Internetmost with IP addresses from the United States. However, Shadowserver does not indicate how many are honeypots or have already been secured against CVE-2026-101767.
Attackers often target Oracle vulnerabilities because they allow them to hack into enterprise systems on the networks of many Fortune 100 companies, government organizations, and healthcare networks around the world.
For example, since early August 2025, the Clop extortion gang has exploited another Oracle EBS flaw (CVE-2025-61882) in zero-day attacks targeting high-profile victims like Logitech, GlobalLogic, and the Washington Post, as well as US universities (including Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix).
Most recently, in June, Oracle released emergency mitigations for a critical PeopleSoft Suite zero-day (CVE-2026-35273) that the ShinyHunters extortion gang exploited. between May 27 and June 9.
By abusing this flaw, malicious actors gained unauthenticated remote code execution on victims’ systems and stole data from numerous organizations around the world, including the University of Nottingham, Nissan, and the National Association of Insurance Commissioners (NAIC).
As of November 2021, CISA has added 46 Oracle security bugs to its list of actively exploited vulnerabilities, 13 of which have also been exploited in ransomware attacks.
Overall prevention scores can mask what happens after initial access. Once attackers use valid credentials, prevention drops significantly.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
