Science & Tech · Cybersecurity · 4 hrs ago
Hackers Probe Newly Patched Oracle E-Business Suite Flaw
Attackers began probing for a critical Oracle E-Business Suite flaw on October 27, according to cybersecurity firm Defused.
The vulnerability affects Oracle E-Business Suite, software used by organizations to manage business operations.
Oracle released a security patch on October 20 and urged customers to install it promptly.
The flaw can be reached over the internet without a login and could let an attacker run code and take control of a vulnerable system.
Oracle has not confirmed that the flaw has been used in successful attacks, and the observed activity was described as exploratory probing.
More than 670 Oracle E-Business Suite systems are exposed to the internet, though it is not known how many remain vulnerable.
Oracle customers should apply the patch; attackers have previously targeted flaws in Oracle enterprise software, putting organizations’ systems and data at risk.
Threat actors have begun probing internet-connected systems for an unpatched critical vulnerability in Oracle E-Business Suite.
The flaw, tracked as CVE-2026-101767, can allow unauthenticated attackers to take over vulnerable systems through remote code execution.
Oracle released security updates for the flaw on October 20, 2026, and urged customers to apply them without delay.
Defused said it observed exploratory exploit attempts on October 27.
Shadowserver tracks more than 670 internet-exposed Oracle EBS instances, but the number that remain vulnerable is not known.
- Who
- Threat actors are probing for vulnerable Oracle E-Business Suite systems. Defused reported observing exploratory exploit attempts.
- What
- Attackers are probing for CVE-2026-101767, a critical vulnerability that can enable remote code execution and system takeover.
- When
- Oracle released a patch on October 20, 2026. Defused observed attempts on October 27.
- Where
- On the internet, targeting Oracle E-Business Suite systems.
- Why
- The flaw can allow unauthenticated attackers to take over vulnerable systems.
This story does not have two clearly opposing sides.
Oracle released security updates for CVE-2026-101767 in its October Critical Security Patch Update.
Defused said its decoys recorded exploratory exploit attempts targeting the vulnerability.
BleepingComputer and SecurityWeek reported that threat actors were probing for vulnerable systems.
- Vulnerability
- CVE-2026-101767
- Product
- Oracle E-Business Suite
- Patch date
- October 20, 2026
- CVSS score
- 9.8
- Observed attempts
- October 27, 2026
- Exposed instances
- More than 670 tracked by Shadowserver
3 sources
What people are saying
In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches.
Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay.
Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27
Posts on X
🚨 Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27. The bug was recently disclosed by @Horizon3ai and