Xavfsizlik razvedkasi firmasi Defused Cyber ma'lumotlariga ko'ra, tahdid aktorlari Oracle E-Business Suite (EBS) da yaqinda yamalgan yangi muhim zaiflikni tekshirishni boshlagan.
Ko'rib chiqilayotgan zaiflik — Oracle E-Business Suite'dagi Oracle Application Object Library'dagi CVE-2026-101767 (CVSS balli: 9.8). U o'tgan hafta Oracle tomonidan Critical Patch Update doirasida yamalgan.
Xavfsizlik tadqiqotchilari Brandon Peterson, Jimi Sebree va Noah King (Horizon3.ai) 2026-yil 24-iyulda zaiflikni aniqlab, Oracle'ga xabar bergan.
"Bizning Oracle E-Business Suite tuzoqlarimiz bugun ertalab, 27-oktabrda, CVE-2026-101767 — EBS'ning Thin Client Framework servletidagi autentifikatsiyasiz SQL in'ektsiyasi, u masofaviy kod bajarilishiga zanjirlanadi — ga qarshi ekspluatatsiya urinishlarini qayd etdi," deb yozdi Defused Cyber X'dagi postida.
Zaiflik bo'yicha maslahatida Horizon3.ai uni autentifikatsiyasiz SQL in'ektsiyasi zaifligi deb ta'rifladi, u masofaviy kod bajarilishini ta'minlash uchun zanjirlanishi mumkin.
"Zaiflik tarmoq orqali ta'sirlangan Thin Client Framework (TCF) servletiga kirish huquqiga ega bo'lgan hujumchiga SQL'ni APPS ma'lumotlar bazasi foydalanuvchisi sifatida bajarish, so'ngra operatsion tizim buyruqlarini EBS ilova hisobi sifatida bajarish imkonini beradi," deb ta'kidladi kiberxavfsizlik kompaniyasi.
Xususan, hujumchi zaif TCF servletiga "/OA_HTML/AppsTCFServer" manzilida maxsus so'rov yuborib, SQL'ni APPS ma'lumotlar bazasi foydalanuvchisi huquqlari bilan bajarishi va oxir-oqibat EBS ilova hisobi huquqlari bilan tizim buyruqlarini bajarishi mumkin.
CVE-2026-101767 muvaffaqiyatli ekspluatatsiya qilinsa, hujumchiga APPS uchun mavjud ilova ma'lumotlarini o'qish yoki o'zgartirish va ilova xostida buyruqlarni bajarish imkonini beradi.
"Joylashuvga qarab, ta'sirlangan ma'lumotlar moliyaviy, ish haqi, HR va xarid yozuvlarini o'z ichiga olishi mumkin. Operatsion tizimga kirish buzilgan EBS ilova hisobining ruxsatlari bilan boshqariladi," deb ogohlantirdi Horizon3.ai.
Internetga ochiq EBS joylashuvlari eng katta xavf tug'dirsa-da, ichki EBS tizimlari ham, agar hujumchi zaif servletga buzilgan tizim yoki boshqa kirish mumkin bo'lgan tarmoq segmentidan yetib borsa, ekspluatatsiya qilinishi mumkin.
Foydalanuvchilarga iloji boricha tezroq so'nggi versiyaga yangilash tavsiya etiladi. Agar darhol yamash mumkin bo'lmasa, quyidagi vaqtinchalik choralar qo'llanilishi mumkin:
- EBS URL xavfsizlik devori ruxsat ro'yxatidan /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer bilan bog'liq) ni olib tashlang.
- EBS veb qatlamiga kirishni ishonchli tarmoqlar bilan cheklang.
- EBS ilova xosti va ma'lumotlar bazasini buzilish alomatlari uchun kuzating.
Horizon3.ai shuningdek, quyidagi buzilish ko'rsatkichlarini ulashdi:
- Gantt ma'lumot-server sinfini (oracle.apps.jtf.gantt.server.GanttDataServer) ishga tushiradigan /OA_HTML/AppsTCFServer ga autentifikatsiyasiz POST so'rovlari, so'ngra orqa taraf ma'lumotlar bazasi faoliyati.
- Autentifikatsiyasiz veb so'rovlardan so'ng tez orada SQL razvedkasi (ma'lumotlar bazasi versiyasi, joriy foydalanuvchi, katalog ob'ektlari).
- $APPLPTMP'dagi kutilmagan fayllar va Concurrent Manager orqali /bin/sh ni ishga tushirib, OS buyruqlarini bajaradigan oracle hisobi.
EBS'dagi zaifliklar hujumchilar uchun issiq nishon. O'tgan yil davomida xuddi shu mahsulotdagi ikkita muhim zaiflik (CVE-2025-61882 va CVE-2026-46817, CVSS ballari: 9.8) faol ekspluatatsiya qilingan, birinchisi Cl0p ransomware va tovlamachilik guruhi tomonidan ishlatilgan.
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber.
The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical Patch Update.
Security researchers Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai have been credited with discovering and reporting the flaw to Oracle on July 24, 2026.
"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, October 27," Defused Cyber said in an X post.
In an advisory for the vulnerability, Horizon3.ai described it as an unauthenticated SQL injection vulnerability that could be chained to achieve remote code execution.
"The vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS application account," the cybersecurity company said.
Specifically, an attacker can issue a crafted request to the vulnerable TCF servlet at "/OA_HTML/AppsTCFServer" to run SQL with the privileges of the APPS database user and ultimately enable system command execution with the privileges of the EBS application account.
Successful exploitation of CVE-2026-101767 can permit an attacker to read or modify application data accessible to APPS and execute commands on the application host.
"Depending on the deployment, affected data may include financial, payroll, HR, and procurement records. Operating system access is governed by the permissions of the compromised EBS application account," Horizon3.ai warned.
While internet-facing EBS deployments present the most risk, internal EBS systems can also be exploited if an attacker can reach the vulnerable servlet from a compromised system or another accessible network segment.
Users are advised to update to the latest version as soon as possible. If immediate patching is not an option, the following workarounds can be applied -
- Remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist.
- Restrict access to the EBS web tier to trusted networks.
- Monitor the EBS application host and database for signs of compromise.
Horizon3.ai has also shared the below indicators of compromise -
- Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class (oracle.apps.jtf.gantt.server.GanttDataServer), followed by backend database activity.
- SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects).
- Unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands.
Vulnerabilities in EBS are a hot target for attackers. Over the past year, two critical flaws in the same product (CVE-2025-61882 and CVE-2026-46817, CVSS scores: 9.8) have come under active exploitation, with the former leveraged by the Cl0p ransomware and extortion crew.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.