What happened
On October 20, 2026, Oracle released its regular quarterly security bundle (Critical Patch Update), which includes a fix for critical flaw CVE-2026-101767. It affects Oracle Application Object Library, the core module of Oracle E-Business Suite (EBS). EBS is a large ERP system that organizations use to run finance, payroll, HR and procurement.
The flaw was found by Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai, who reported it to Oracle on July 24, 2026. According to Horizon3.ai, an attacker who is not logged in can slip their own commands into the database and then go on to run commands on the server itself.
Defused, a company that runs decoy systems (honeypots) imitating EBS, said it recorded the first exploratory exploitation attempts on the morning of October 27, 2026. Both The Hacker News and Help Net Security reported on this. As of October 29, 2026, the flaw is not in the CISA KEV catalog, and the European EUVD database does not list it as exploited yet.
EBS has been a popular target for some time. The Cl0p group exploited CVE-2025-61882 in 2025 to steal data, and in June 2026 Defused saw attempts to exploit CVE-2026-46817 in the Oracle Payments module.
Why it is dangerous
The flaw is classified as an authentication weakness (CWE-287 and CWE-306): a part of the system that should first check who is talking to it skips that check. Horizon3.ai describes it as SQL injection, meaning an attacker sends a crafted request and the system runs it as a database command.
Picture a mailroom that accepts any letter without checking the sender and passes the instructions inside straight to the archive for action. According to Horizon3.ai, this lets an attacker run SQL with the privileges of the APPS database user and, from there, run operating system commands under the account EBS runs as.
- Login: the attacker needs no username or password.
- Attack path: network access to the EBS web tier over HTTP is enough. Internet-facing systems are most at risk, but according to The Hacker News internal ones are too if an attacker reaches the network, for example through another compromised machine.
- Impact: according to Horizon3.ai, reading and changing data available to the APPS account (financial, payroll, HR and procurement records) and running commands on the application server within the EBS account’s permissions.
The CVSS score rates severity on a scale from 0 to 10. Oracle gave this flaw 9.8 under CVSS 3.1, which is critical. EPSS estimates the chance of exploitation in the next 30 days: as of October 29, 2026 it is about 0.6%, higher than roughly half of known flaws. EPSS reacts to new attacks with a delay, so do not treat it as reassurance.
Who is affected
Oracle lists supported Oracle E-Business Suite versions 12.2.3 to 12.2.15 as affected, specifically the Oracle Application Object Library module (Core component). Installations without the October 2026 Critical Patch Update are at risk.
EBS is typically found in mid-sized and larger companies, subsidiaries of multinational groups, the public sector, or with partners who run it for clients. It runs in on-premises data centers, at hosting partners or in the cloud, and its web tier is often exposed to staff, suppliers and partners over the internet. In its October 28, 2026 advisory, Censys counted 2,246 internet-facing web services running EBS. Each hostname and port is counted separately, so the number of actual servers is lower. Censys cannot tell how many of them are vulnerable.
If you do not use EBS, this flaw does not affect you. The Oracle database on its own and other Oracle products are not listed as affected in this advisory. Oracle says nothing about older, unsupported EBS versions, so treat them as at risk.
How to check if you are affected
First find out whether you run EBS and whether its web tier is reachable from the internet. You can get the version from the database with this read-only query:
SELECT release_name FROM apps.fnd_product_groups;If the result is between 12.2.3 and 12.2.15, the version is affected. To confirm the October fix is applied, compare against the patch numbers in Oracle’s October 2026 Critical Patch Update documentation. This query lists installed patches:
SELECT bug_number, last_update_date FROM ad_bugs ORDER BY last_update_date DESC;Also review the web server (Oracle HTTP Server) access logs for POST requests to /OA_HTML/AppsTCFServer. On EBS 12.2 they are usually under $IAS_ORACLE_HOME/instances/*/diagnostics/logs/OHS/, but the path can differ. Run the command as the application tier owner after sourcing the EBS environment. It is read-only and also searches older compressed logs:
zgrep -iE 'POST [^ ]*/OA_HTML/AppsTCFServer' "$IAS_ORACLE_HOME"/instances/*/diagnostics/logs/OHS/*/access_log*A match alone does not prove an attack. Focus on requests from unknown addresses and compare them with the indicators in the compromise section.
How to fix it
Oracle fixed the flaw in its Critical Patch Update of October 20, 2026. Oracle’s description does not name a fixed version number. What matters is having the October patches installed. Oracle warns that in some cases attackers succeeded precisely because customers had not applied available patches, and recommends staying on supported versions and patching without delay.
- Identify which EBS instances are reachable from the internet or by partners. Handle those first.
- If you cannot patch right away, Horizon3.ai advises removing
/OA_HTML/AppsTCFServer(classoracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist and restricting access to the EBS web tier to trusted networks, for example via VPN. - Download the October 2026 Critical Patch Update documentation and patches for your EBS version from My Oracle Support.
- Test the update in a test environment if you have one, then roll it out to production using your usual process (online patching with
adop). - After updating, confirm the patches are applied and check the system for signs of compromise as described in the next section.
Temporary measures do not replace the patch. They only reduce risk until you install it.
What if you may already be compromised
If your EBS was reachable from the internet and unpatched, Censys recommends reviewing it for signs of compromise. Horizon3.ai has published these indicators:
- Unauthenticated POST requests to
/OA_HTML/AppsTCFServerthat instantiate the classoracle.apps.jtf.gantt.server.GanttDataServer, followed by database activity. - SQL reconnaissance shortly after unauthenticated web requests, such as queries for the database version, the current user or directory objects.
Also look for new or modified files and unusual processes under the account EBS runs as, unknown EBS accounts and unusual outbound connections from the server. If you find anything, preserve the logs, do not delete suspicious files and bring in an incident response specialist. Since payroll and HR data may be involved, keep in mind the GDPR duty to notify your data protection authority within 72 hours.