Oracle EBS RCE (CVE-2026-101767): unauthenticated SQL injection to code execution
An unauthenticated SQL injection in the EBS Thin Client Framework chains to code on the server. Oracle fixed it on October 20, attackers began probing on October 27, and ERP patch windows run in weeks. Apply the October 2026 CPU, and prove which instances an attacker can reach.
SEVERITY
Critical
PEAK CVSS
9.8
AUTH REQUIRED
None
PUBLIC POC
Not confirmed
PUBLISHED
Oct 28, 2026
REVISION
v1.0 · @Melly
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking a critical, unauthenticated SQL injection in Oracle E-Business Suite that chains to remote code execution. Oracle fixed it in the October 2026 Critical Patch Update on Oct 20; threat intelligence recorded exploit probing on Oct 27. EBS holds finance, supplier and HR data, which makes it a prized target. Apply the CPU to every instance, and reduce internet exposure where you can today.
KEY JUDGMENTS
01
Defused recorded exploratory exploit attempts against its EBS decoys on Oct 27, one week after the fix shipped.Observed
02
Running EBS is not exposure. Exposure is a Thin Client Framework endpoint reachable from a network the attacker controls, most often an external portal or a forgotten clone.Assessed
03
EBS has been targeted before. In 2025 the Cl0p group used a separate EBS zero-day, CVE-2025-61882, to steal data at scale.Observed
04
ERP patch cycles run in weeks. Reachability is the control you can change today, before the patch window arrives.Assessed
October 2026 Critical Patch Update (also fixes CVE-2026-101809)
Impact
SQL injection chaining to remote code execution. No authentication.
EXPOSURE: REACHABILITY DECIDES PRIORITY
01Affected versionEBS 12.2.3 to 12.2.15.
02Internet-facing nodeSupplier or self-service portals, or a load balancer that exposes the web tier.
03CPU not appliedAny instance still awaiting the October 2026 CPU.
04Clone or testCopies of production data, usually patched last.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDProbing seenExploit attempts on decoys Oct 27.
PUBLIC POCNot confirmedNo public PoC referenced yet.
CISA KEVNot listedNot in KEV as of Oct 28.
PATCHAvailableOctober 2026 CPU, released Oct 20.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
Jul 24Horizon3.ai reports the flaw to Oracle.
Oct 20Oracle releases the October 2026 Critical Patch Update and publishes the CVE.
Oct 21The SANS Internet Storm Center flags the flaw in its daily brief.
Oct 27Defused records exploratory exploit attempts against its EBS decoys.
04 · AFFECTED PRODUCTS
Affected and fixed versions
Reachability, not the version, sets priority. An affected version is urgent when a node is reachable from the internet and the October CPU is not yet applied.
PRODUCT
AFFECTED
FIXED IN
STATUS
EBS Application Object Library (Core)
12.2.3 to 12.2.15
October 2026 CPU
Fixed
EBS Workflow Notification Mailer
12.2.3 to 12.2.15 (CVE-2026-101809)
Same CPU, apply together
Fixed
Before 12.2.3
all
None. Upgrade and isolate
No fix
CONFIRM PATCH IDSReplace the placeholder patch numbers in the validation query with the real ones from Oracle's October 2026 CPU documentation before running it.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Internet-facing EBSHighest priority. Apply the October CPU now, or pull the node off the public internet.
External portalsRestrict iSupplier and iRecruitment pages to a VPN or allow list until patched.
HighWithin the change window
All production EBSApply the EBS patches from the October CPU through online patching. Apply CVE-2026-101809 with it.
Clones, test and DRPatch them too, or take them off any reachable network.
Before 12.2.3Plan the upgrade and isolate now. No fix exists.
HighBefore closing
Every instanceRecord the release, the CPU patch IDs and the reachability result as evidence.
WORKAROUNDS
Remove internet access. Take any EBS page that does not need public access behind a VPN or allow list.Lock down external nodes. Follow Oracle's DMZ guidance so external nodes expose only the responsibilities they need.Filter and test. Add and test a WAF rule that blocks SQL injection against EBS endpoints.Raise logging. Increase logging on the EBS web tier so probes are visible.
06 · DETECTION AND HUNTING
Observables and hunting queries
No stable file hashes are published. Hunt on reachability and on SQL injection patterns against EBS servlets.
TYPE
OBSERVABLE
SOURCE
Request
SQL syntax in requests to EBS servlets (union select, dbms_)
EBS web tier access logs
Exposure
An EBS web tier reachable from the internet
External scan, edge config
Exposure
An instance without the October CPU applied
ad_bugs query on each instance
HUNT · CVE-2026-101767injection markers since Oct 20
SELECT bug_number, creation_date FROM apps.ad_bugs WHERE bug_number IN ('<cpu-patch-1>','<cpu-patch-2>');
07 · MITRE ATT&CK
Technique mapping
TACTIC
ID
TECHNIQUE
BASIS
Initial Access
T1190
Exploit Public-Facing Application
Observed
Execution
T1059
Command and Scripting Interpreter (post-exploitation)
Theoretical
08 · TECHNICAL ANALYSIS
Root cause and attack path
The Thin Client Framework servlet is part of the Application Object Library, the shared foundation across EBS. It accepts input over HTTP and builds a database query from it without escaping, a classic SQL injection. Because the servlet requires no credentials, an attacker needs only network reach.
Horizon3.ai, which reported the flaw, describes the injection chaining to remote code execution on the EBS server. The October CPU fixes the servlet and, in the same update, CVE-2026-101809 in the Workflow Notification Mailer on the same versions, so apply both together. The gap between patch and probe was seven days; reachability is the control teams can change before the patch window.
01 REACH
Attacker reaches the TCF servlet over HTTP, no login
A 2025 EBS zero-day used by Cl0p for data theft. Shows the target history.
AssessedThe window from patch to probe was seven days, far shorter than a typical ERP change cycle. Reachability is the control you own today.
09 · VALIDATION
Confirm remediation
A confirmed version is not a verdict. Each instance should end with a result: patched, not reachable, or exposed. Replace the placeholder patch numbers with the real ones from Oracle's October CPU before running step 02.
01
Confirm the EBS release
Run as the APPS user.
SELECT release_name FROM apps.fnd_product_groups;
02
Confirm the October CPU is applied
Use the patch numbers from Oracle's October 2026 CPU documentation.
SELECT bug_number, creation_date FROM apps.ad_bugs
WHERE bug_number IN ('<cpu-patch-1>','<cpu-patch-2>');
03
Prove reachability from three vantage points
Internet, corporate network, and another host that can route to the web tier.
# test the TCF endpoint from each vantage; the external result sets priority
04
Search the web tier for probes
Look for SQL syntax in requests to EBS servlets since Oct 20.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Which EBS versions are affected?
Versions 12.2.3 through 12.2.15.
Is CVE-2026-101767 being exploited?
Defused saw exploratory exploit attempts against its decoys on October 27, 2026. It was not in CISA's KEV catalog as of October 28.
How do I fix it?
Apply Oracle's October 2026 Critical Patch Update to every EBS instance, including clones and test systems.
What can I do before the patch window?
Reachability is the control you own today. Take any EBS page that does not need public access off the internet.
VALIDATE YOUR EXPOSURE
Prove your ERP is not exposed
Hayrok maps your EBS footprint, confirms the release and the CPU on each instance, and tests reachability from inside and outside. Every result lands in Evidence Fabric.