Hujumchilar yaqinda e'lon qilingan muhim Oracle E-Business Suite (EBS) zaifligiga qarshi tuzatilmagan tizimlar uchun Internetni tekshirishni boshladi.
EBS'ning Application Object Library yadroviy komponentida aniqlangan va CVE-2026-101767 sifatida kuzatiladigan bu zaiflik, HTTP tarmoq kirishiga ega autentifikatsiyalanmagan tahdid aktorlariga past murakkablikdagi hujumlarda zaif tizimlarni egallab olish imkonini beradi.
Oracle 20-oktabrda o'zining 2026-yil oktyabr oyidagi Critical Security Patch Update'da muammoni hal qilish uchun xavfsizlik yangilanishlarini e'lon qildi va mijozlardan tizimlarini darhol tuzatishni so'radi.
"Ba'zi hollarda, hujumchilar muvaffaqiyatli bo'lganligi haqida xabar berilgan, chunki maqsadli mijozlar mavjud Oracle tuzatishlarini qo'llamagan," deb aytdi. "Shuning uchun Oracle mijozlarga faol qo'llab-quvvatlanadigan versiyalarda qolishni va xavfsizlik tuzatishlarini kechiktirmasdan qo'llashni qat'iy tavsiya qiladi."
Oracle hali CVE-2026-101767 ni yovvoyi tabiatda ekspluatatsiya qilingan deb belgilamagan bo'lsa-da, Defused tahdid razvedkasi kompaniyasi seshanba kuni allaqachon tahdid aktorlarining zaif tizimlar uchun Internetni skanerlashini aniqlaganini aytdi.
"Bizning Oracle E-Business Suite tuzoqlarimiz CVE-2026-101767 ga qarshi sinov ekspluatatsiyalarini qayd etdi — bu EBS'ning Thin Client Framework servletidagi autentifikatsiyalanmagan SQL in'ektsiyasi bo'lib, u masofaviy kod bajarilishiga zanjirlanadi, bugun ertalab, 27-oktabr," deb ogohlantirdi Defused.
Internet tahdid kuzatuvchisi Shadowserver hozir 670 dan ortiq Internetga ochiq Oracle EBS nusxalarini kuzatmoqda, ularning aksariyati AQShdan IP manzillarga ega. Biroq, Shadowserver ularning qanchasi tuzoq (honeypot) ekanligini yoki CVE-2026-101767 zaifligiga qarshi allaqachon himoyalanganligini ko'rsatmaydi.
Internetga ochiq Oracle EBS nusxalari (Shadowserver)
Hujumchilar ko'pincha Oracle zaifliklarini nishonga oladi, chunki ular dunyo bo'ylab ko'plab Fortune 100 korporatsiyalari, davlat tashkilotlari va sog'liqni saqlash tarmoqlarining tarmoqlaridagi korporativ tizimlarga kirish imkonini beradi.
Masalan, 2025-yil avgust oyining boshidan beri, Clop shantaj to'dasi Logitech, GlobalLogic va Washington Post kabi yuqori profilli qurbonlarga, shuningdek AQSh universitetlariga (jumladan Garvard universiteti, Pensilvaniya universiteti, Dartmut kolleji va Feniks universiteti) qaratilgan nol-kun hujumlarida boshqa Oracle EBS zaifligini (CVE-2025-61882) ekspluatatsiya qilgan.
Yaqinda, iyun oyida, Oracle ShinyHunters shantaj to'dasi 27-may va 9-iyun oralig'ida ekspluatatsiya qilgan muhim PeopleSoft Suite nol-kun zaifligi (CVE-2026-35273) uchun favqulodda yumshatish choralarini e'lon qildi.
Bu zaiflikni suiiste'mol qilish orqali tahdid aktorlari qurbonlar tizimlarida autentifikatsiyalanmagan masofaviy kod bajarilishini qo'lga kiritdi va dunyo bo'ylab ko'plab tashkilotlardan, jumladan Nottingem universiteti, Nissan va Sug'urta komissarlari milliy assotsiatsiyasi (NAIC) dan ma'lumotlarni o'g'irladi.
2021-yil noyabr oyidan beri, CISA o'zining faol ekspluatatsiya qilinadigan zaifliklar ro'yxatiga 46 ta Oracle xavfsizlik xatosini qo'shdi, ularning 13 tasi ransomware hujumlarida ham suiiste'mol qilingan.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% bloklanadi.
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanayotganda, oldini olish keskin pasayadi.
The Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyalarni o'lchaydi.
Hisobotni oling
Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.
Discovered in a core component of EBS's Application Object Library and tracked as CVE-2026-101767, this flaw lets unauthenticated threat actors with HTTP network access take over vulnerable systems in low-complexity attacks.
Oracle released security updates to address the issue in its October 2026 Critical Security Patch Update on October 20 and urged customers to patch their systems immediately.
"In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches," it said. "Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
While Oracle has not yet tagged CVE-2026-101767 as exploited in the wild, threat intelligence company Defused said on Tuesday that it already spotted threat actors scanning the Internet for vulnerable systems.
"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27," Defused warned.
Internet threat watchdog Shadowserver now tracks over 670 Internet-exposed Oracle EBS instances, most of them with IP addresses from the United States. However, Shadowserver doesn't indicate how many are honeypots or have already been secured against the CVE-2026-101767 flaw.
Internet-exposed Oracle EBS instances (Shadowserver)
Attackers often target Oracle vulnerabilities because they let them breach enterprise systems on the networks of many Fortune 100 corporations, government organizations, and healthcare networks around the world.
For instance, since early August 2025, the Clop extortion gang has exploited another Oracle EBS flaw (CVE-2025-61882) in zero-day attacks targeting high-profile victims like Logitech, GlobalLogic, and the Washington Post, as well as US universities (including Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix)
More recently, in June, Oracle released emergency mitigations for a critical PeopleSoft Suite zero-day (CVE-2026-35273) that the ShinyHunters extortion gang exploited between May 27 and June 9.
By abusing this flaw,the threat actors gained unauthenticated remote code execution on victims' systems and stole data from many organizations worldwide, including Nottingham University, Nissan, and the National Association of Insurance Commissioners (NAIC).
Since November 2021, CISA has added 46 Oracle security bugs to its list of actively exploited vulnerabilities, 13 of which have also been abused in ransomware attacks.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report