Asl matn EN tilida, manba saytidan olindi. Manba ↗

Vulnerabilities

Hackers Start Probing Fresh Oracle EBS Vulnerability

CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution.

By

Ionut Arghire

| October 28, 2026 (5:14 AM ET)

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

Threat actors have started probing for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), threat intelligence firm Defused reports.

The exploited flaw, tracked as CVE-2026-101767 (CVSS score of 9.8), was patched last week in Oracle’s October CPU.

It is described as an SQL injection issue in the Application Object Library product of EBS that could be exploited by remote, unauthenticated attackers over HTTP.

Successful exploitation of the bug could allow attackers to achieve remote code execution (RCE) and completely take over the Application Object Library.

According to Defused, the first exploitation attempts targeting CVE-2026-101767 were observed on October 27.

“Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27,” the company warned on X.

Advertisement. Scroll to continue reading.

The security defect was discovered and reported by Horizon3.ai and there have been no other reports regarding its in-the-wild exploitation.

Oracle EBS vulnerabilities are often targeted by threat actors. In June, Defused warned of attacks exploiting CVE-2026-46817, a critical issue in the File Transmissions component of E-Business Suite’s Payments product.

Last year, the Cl0p ransomware and extortion group exploited zero-day bugs in Oracle’s enterprise management software to access stored data.

The large-scale EBS hacking campaign potentially impacted over 100 organizations across consumer goods, energy, engineering, entertainment, finance, heavy industry, manufacturing, media, software, technology, telecommunications, and other industries.

Related:CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts

Related:Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

Related:HPE Patches Dozens of Critical Flaws in Networking Products

Related:iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Written ByIonut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

More from Ionut Arghire

  • Dead Popcorn Time Updater Put Millions of Computers at Risk of Takeover
  • Genesys Hack Exposes Customer Data From Internal Systems
  • 953 Online Stores Infected in Long-Lasting Malware Campaign
  • Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts
  • Mythos 5 Ignored Real-World Harm in July Attack
  • China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  • Attackers Exploit Third Arista VCO Zero-Day in Four Months
  • 11 Million Impacted by Capcom Data Breach

Latest News

  • CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
  • Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
  • Vendor Key Leak Puts Data of 238,000 Denver Health Plan Members at Risk
  • HPE Patches Dozens of Critical Flaws in Networking Products
  • Unexplained DreamHost Incident Prompts Email, FTP Password Resets
  • iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18
  • Risks Spelled Out for Anthropic Investors Include Possible Harms From Runaway AI
  • This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Trending

Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages

PHP2Shell Exploitation Moves From Probes to Working Shells

Genesys Hack Exposes Customer Data From Internal Systems

iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18

Dutch Police Arrest Two Over NFC Relay Attacks That Drained $400,000+ From Bank Accounts

Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics

Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws

953 Online Stores Infected in Long-Lasting Malware Campaign

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Business Email*

emailsignupsource

Read our Privacy Policy for more information.

Webinar: The AI Access Risk Already in Your Google Workspace

October 19, 2026

AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.

Register

Virtual Event: CISO Forum 2026 Summit

November 10 & 11, 2026

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Register

People on the Move

Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.

Neo has appointed Scott Stout as CRO.

CISA has sworn in Kan Wang as CFO and Khoi Nguyen as CAE.

More People On The Move

Expert Insights

*

  • Flipboard
  • Reddit
  • Whatsapp
  • Whatsapp
  • Email

This is Fine: What NetScaler Zero-Days Tell Us About the New Normal

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

The Key to AI Software Security Isn’t Speed, It’s Maturity

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Context Is King in the Fight Against Modern Cyberattacks

Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)

AI Has Changed Attack Speed, Not Security Fundamentals

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)

Four Cyber Threats Harboring Big Plans for the Future

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)