Threat intelligence firm Defused recorded exploitation attempts against a newly patched Oracle E-Business Suite (EBS) vulnerability on October 27, according to SecurityWeek. The activity targeted CVE-2026-101767, a critical flaw that remote attackers could exploit over HTTP without authentication.
The observations came from Defused’s EBS decoys. The company described the activity as “exploratory exploits,” providing evidence of attempts against those systems, rather than confirmed compromises of customer deployments. SecurityWeek reported no other accounts of in-the-wild exploitation.
CVE-2026-101767 is described in SecurityWeek’s report as an SQL injection vulnerability in EBS’s Application Object Library. Successful exploitation could allow remote code execution and complete takeover of that component. Its CVSS score of 9.8 describes the vulnerability’s severity; it does not establish that an attack succeeded.
Oracle addressed the flaw in its October 2026 Critical Patch Update, initially released on October 20, a week before Defused’s observations. Oracle credits Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King for CVE-2026-101767.
The advisory lists Oracle E-Business Suite versions 12.2.3–12.2.15 among products affected by vulnerabilities addressed in the October update. That is the update’s product-level scope, rather than a CVE-specific affected-version list.
For patch availability and installation instructions, Oracle directs customers to the E-Business Suite Patch Availability Document linked from the advisory. The vendor strongly recommends remaining on actively supported versions and applying security patches without delay, citing reports of successful attacks against customers that had not installed available fixes.
