# Oracle E-Business Suite detection pack: CVE-2026-101767 (Oracle Critical Patch Update October 2026)

Read-only checkers and hunting content for CVE-2026-101767, a critical, unauthenticated vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (EBS), component Core. Oracle fixed it in the October 2026 Critical Patch Update, released on 20 October 2026. Last refreshed 28 October 2026, 13:22 GMT, against Oracle, CISA (KEV feed), NVD and CVE.org primary sources.

Public research describes it as SQL injection through the Thin Client Framework (TCF) servlet `/OA_HTML/AppsTCFServer`, leading to remote code execution. Oracle's text does not describe the mechanism; see "What is and is not confirmed" below.

## Status at a glance (checked 28 Oct 2026)

| Item | Status | Source |
|---|---|---|
| Oracle advisory | Critical Patch Update October 2026, Rev 1 (initial release) 20 Oct 2026; Rev 2 on 26 Oct 2026 updated credits and another product, not this row. EBS risk matrix: CVE-2026-101767, Oracle Application Object Library, component **Core**, protocol HTTP, remote exploit without authentication **Yes**, CVSS 3.1 **9.8** `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, supported versions affected **12.2.3-12.2.15** | [Oracle CPU October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html) |
| Oracle description | "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library." | [Oracle CPU text form](https://www.oracle.com/security-alerts/cpuoct2026verbose.html) |
| Oracle bug ID | **39800355** (Oracle's CSAF file, "Oracle Bug ID of Oracle Application Object Library"). Remediation points to My Oracle Support Note KA923 | [Oracle CSAF](https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json) |
| Patch number | **Not confirmed.** Oracle's public CPU pages and CSAF give no patch number. The per-release patches are listed in MOS Note KA923 (Oracle E-Business Suite Release 12 Critical Patch Update Knowledge Document, October 2026), which needs a My Oracle Support login and was not read | [KA923](https://support.oracle.com/support/?documentId=KA923) (login) |
| NVD | `Awaiting Analysis`. **NVD has not scored it**; the only score is Oracle's (CNA, `secalert_us@oracle.com`, Secondary) 9.8. Published 20 Oct 2026, last modified 21 Oct 2026. CWE-287 and CWE-306 added by CISA-ADP | [NVD CVE-2026-101767](https://nvd.nist.gov/vuln/detail/CVE-2026-101767) |
| CVE record | CNA Oracle, published 20 Oct 2026 21:22 UTC. Affected: Application Object Library 12.2.3 to 12.2.15 inclusive. CISA-ADP SSVC (21 Oct 2026): Exploitation **none**, Automatable **yes**, Technical Impact **total** | [CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-101767) |
| Exploitation | **Not confirmed by Oracle or CISA.** Public research reports exploitation attempts began on 27 Oct 2026 (unverified by Oracle/CISA) | - |
| CISA KEV | **Not listed.** CVE-2026-101767 is not in the CISA KEV catalog (catalog `2026.10.27`). No CISA due date applies | [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) |
| Fix | Apply the October 2026 CPU patches for EBS (and its prerequisites) as listed in KA923 | Oracle CPU, KA923 |

### CISA KEV

Fetched from the [KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) at 13:22 GMT on 28 Oct 2026 (`catalogVersion` `2026.10.27`, `dateReleased` `2026-10-27T19:00:02.2307Z`, 19:00 GMT on 27 Oct; 1760 entries).

CVE-2026-101767 is **not in the CISA KEV catalog**. There is no CISA due date for it. Absence from KEV means CISA has not (yet) confirmed exploitation; it does not mean the flaw is safe to leave. Re-check the feed, and patch now regardless.

For context only, the same feed lists earlier Oracle EBS vulnerabilities, three of them with `knownRansomwareCampaignUse` `Known`: CVE-2025-61882 (added 2025-10-06), CVE-2025-61884 (added 2025-10-20) and CVE-2022-21587 (added 2023-02-02). CVE-2026-46817 (added 2026-07-15) is `Unknown`. Internet-facing EBS has been a repeat target.

## Affected and fixed versions (Oracle CPU October 2026)

| Product / component | Affected (Oracle) | Fixed | Notes |
|---|---|---|---|
| Oracle E-Business Suite, Oracle Application Object Library, component Core | **12.2.3-12.2.15** | October 2026 CPU patch for your release, per MOS Note KA923 | Patch number not public; Oracle bug 39800355 |
| EBS 12.2.0-12.2.2 | Not listed (no CPU patch is offered for these releases) | Upgrade to a supported 12.2.x, then apply the CPU | Treat as exposed |
| EBS 12.2.16 and later | Not listed | Confirm in KA923 that it includes the October 2026 CPU content | |
| EBS 12.1 and earlier | Not assessed by Oracle (out of support for CPUs) | None | Treat as exposed, restrict the web tier, plan an upgrade |

The same EBS risk matrix has other serious entries (for example CVE-2026-101809 in Oracle Workflow, Notification Mailer, 10.0, unauthenticated). Apply the whole EBS CPU, not just this one fix. Oracle's EBS section lists 194 new security patches, 31 of them remotely exploitable without authentication.

## What is and is not confirmed

**Confirmed by Oracle / NVD / CVE.org:** the product and component (Application Object Library, Core), affected versions 12.2.3-12.2.15, CVSS 9.8, unauthenticated over HTTP, "takeover of Oracle Application Object Library", the October 2026 CPU fix and KA923, bug 39800355.

**Public research only (NOT confirmed by Oracle, NVD or CISA):**

- the entry point is the Thin Client Framework servlet `/OA_HTML/AppsTCFServer` (class `oracle.apps.fnd.tcf.SocketServer`), which the default `url_fw.conf` allowlist permits;
- unauthenticated POST requests instantiate `oracle.apps.jtf.gantt.server.GanttDataServer`, which leads to SQL injection running as the `APPS` database user;
- follow-on SQL recon (database version, current user, directory objects), files written to `$APPLPTMP`, and OS commands run as the `oracle` / `applmgr` account (for example `/bin/sh` spawned through the Concurrent Manager);
- exploitation attempts beginning on 27 Oct 2026 (unverified by Oracle/CISA).

The detections key on these behaviours because they are what you can see in logs. Treat them as hypotheses that fit the public descriptions, not as Oracle-confirmed facts.

No IOCs are given: Oracle and CISA published none, and none are invented here. Every IP in this pack is an RFC 5737 documentation address or an obvious `PLACEHOLDER`.

## Proactive steps

1. **Find every EBS 12.2.x instance**, internet-facing and internal, including DR, test and cloned environments. For each, read `FND_PRODUCT_GROUPS.release_name` (see `sql/check_patch.sql`).
2. **Patch internet-facing instances first**, then internal ones: apply the October 2026 CPU patches and prerequisites listed in MOS Note KA923 for your release. Internal instances matter too: one compromised laptop or VPN account puts them in reach.
3. **Until patched, close the reported entry point:**
   - remove (comment out) the `AppsTCFServer` / `SocketServer` allow rules from `url_fw.conf`. Do it in the AutoConfig template, not only the generated file: copy `$FND_TOP/admin/template/url_fw_conf_FMW.tmp` to `$FND_TOP/admin/template/custom/`, edit it there and rerun AutoConfig, or AutoConfig will put the rule back ([Oracle EBS 12.2 documentation](https://docs.oracle.com/cd/E26401_01/doc.122/e64384/T656045T2005366.htm)). ASSUMPTION: some Forms or Gantt features may rely on the TCF servlet; test on a clone first;
   - restrict the EBS web tier (OHS, load balancer, WAF) to trusted networks, and if any external access is needed, put it behind VPN or authenticated reverse proxy;
   - run `scripts/check-oracle-ebs.sh --url-fw` (or `Check-OracleEbs.ps1 -UrlFw`) on the generated `url_fw.conf` to confirm the rule is gone.
4. **Enable and keep logs:** OHS access logs (with request method and status), load balancer / WAF logs, WebLogic logs, database audit, and Defender for Endpoint on the app and DB tiers. Forward them to Microsoft Sentinel so the KQL below can run.

## Reactive steps (hunt), and why patched does not mean clean

**Patched does not mean clean.** The patch closes the hole; it does not remove anything an attacker already left behind. Hunt over the whole period each instance ran without the October 2026 CPU, and at least from 20 Oct 2026.

Look for:

1. **Unauthenticated POSTs to `/OA_HTML/AppsTCFServer`** that were served (2xx) from outside your user networks (checker access-log hunt; KQL Q1-Q4; Sigma webserver rules).
2. **`GanttDataServer` instantiation**: any request naming `GanttDataServer`, or WebLogic / application log entries showing the class loaded outside normal Gantt use. Request bodies are rarely logged, so absence is weak evidence.
3. **SQL recon right after unauthenticated web requests**: database audit or AWR / ASH entries from the `APPS` session pool querying version, `USER`, `DBA_DIRECTORIES` / `ALL_DIRECTORIES` or creating directory objects shortly after a TCF POST (optional hunt queries H5 and H6 in `sql/check_patch.sql`).
4. **Unexpected files in `$APPLPTMP`** (and `OA_HTML`): scripts, JSPs, classes, JARs, ELF binaries, executable files or symlinks (checker `--applptmp`; KQL Q6; Sigma file_event rules).
5. **The `oracle` / `applmgr` account spawning `/bin/sh`** or recon / download tools via the Concurrent Manager (`FNDLIBR`), the web tier JVM (`java` oacore / forms) or the database (`oracle`, `extjob`) (KQL Q5 and Q9; Sigma process_creation rules), plus new or changed host-type concurrent programs (`EXECUTION_METHOD_CODE = 'H'`, hunt queries H1-H3).
6. **Unusual outbound connections** from the app and DB tiers (KQL Q7).

**If you find any of these:**

- isolate the instance (network-level; do not wipe it);
- keep the web (OHS, LB, WAF), WebLogic, concurrent manager and database logs, audit trails and a disk / memory image;
- rotate the `APPS`, `SYSADMIN`, `APPLSYS`, `SYSTEM`, `SYS` and other privileged EBS and database credentials, plus WebLogic admin and any integration or service account whose credentials EBS stores;
- treat the EBS data (finance, HR, suppliers, customers) as possibly stolen and involve legal / DPO for breach-notification decisions;
- then patch, rebuild from a known-good state where possible, and keep monitoring.

## Files

| Path | What it is |
|---|---|
| `scripts/check-oracle-ebs.sh` | Bash checker (Linux app tier or an analyst box). Read-only and offline |
| `scripts/Check-OracleEbs.ps1` | PowerShell 7 checker with the same logic and output |
| `sql/check_patch.sql` | Read-only SELECTs: release, code levels, AD_BUGS / AD_APPLIED_PATCHES, optional hunt queries |
| `kql/oracle-ebs-hunting.kql` | Microsoft Sentinel / Defender XDR hunting queries Q1-Q9 |
| `sigma/*.yml` | 9 Sigma rules: 4 webserver (including 1 event-count correlation), 3 process_creation, 2 file_event |
| `tests/run_tests.sh`, `tests/Check-OracleEbs.Tests.ps1` | Bash and Pester suites with synthetic fixtures in `tests/fixtures/` |

## Checker usage

Both checkers are **strictly read-only and offline**. They read only the files you pass, never connect to EBS, the database or any URL, never send a request to `/OA_HTML/AppsTCFServer`, send no network traffic, never write, move or delete a file, never execute a file they find, and contain no exploit payloads.

```bash
# On an analyst box with exported files (or on the app tier). NNNNNNNN is a placeholder for a patch number
# YOU confirmed in KA923; leave --fix-patch out if you have not.
bash scripts/check-oracle-ebs.sh \
  --release 12.2.12 \
  --context-file ./PLACEHOLDER_EBS_apphost.xml \
  --patch-list ./ad_bugs.csv \
  --fix-patch NNNNNNNN \
  --url-fw ./url_fw.conf \
  --access-log ./access_log --access-log ./access_log.1.gz \
  --trusted 192.0.2.0/24 \
  --applptmp /usr/tmp
```

- `--release`: `FND_PRODUCT_GROUPS.release_name` (or let `--context-file` supply `s_apps_version`).
- `--patch-list`: the AD_BUGS / AD_APPLIED_PATCHES export from `sql/check_patch.sql` (CSV, one per line, or delimited).
- `--trusted`: your user / admin networks (IPv4 CIDR or IP; IPv6 exact address), repeatable or comma-separated.
- `--applptmp`: the `s_applptmp` directory; files are listed and their first bytes read, never executed.

```powershell
pwsh -File scripts/Check-OracleEbs.ps1 -Release 12.2.12 -ContextFile .\ctx.xml -PatchList .\ad_bugs.csv `
  -UrlFw .\url_fw.conf -AccessLog .\access_log -Trusted 192.0.2.0/24 -Applptmp /usr/tmp
```

At least one input is required. `--fix-patch` takes digits only; `EBS_MAX_LIST` (bash) or `-MaxList` caps the indicator list (default 200).

### Verdicts and exit codes

| Exit | Verdict | When |
|---|---|---|
| 0 | PATCHED | 12.2.3-12.2.15 and the `--fix-patch` you confirmed in KA923 is in the patch list; or 12.2.16 and later (confirm in KA923) |
| 1 | LIKELY VULNERABLE | 12.2.3-12.2.15 and the confirmed fix patch is missing; or a non-empty patch list without Oracle bug 39800355 (ASSUMPTION: the CPU patch records this bug in AD_BUGS); or 12.2.0-12.2.2 (no CPU patch offered) |
| 1 | INDICATORS FOUND | any indicator (served untrusted POST to AppsTCFServer, served request naming GanttDataServer, suspicious APPLPTMP file). Overrides every release verdict, including PATCHED |
| 2 | UNKNOWN | no release given; context file shows only the base 12.2.0; 12.2.3-12.2.15 without a patch list, or with bug 39800355 present but no confirmed patch number; 12.1 / 11i (not assessed by Oracle); unparsable release |
| 3 | error | no inputs, unreadable file, unknown argument, bad `--fix-patch` / `--trusted` |

**Patch presence** is reported as UNKNOWN unless you supply both `--fix-patch` and `--patch-list`, because Oracle's public text gives no patch number. The checker does not hardcode any patch number. Every run ends with a status block: `CISA KEV: NOT LISTED ... (catalog 2026.10.27 ...) No CISA due date applies`, the unverified exploitation line, the Oracle CPU / KA923 advice and the "PATCHED DOES NOT MEAN CLEAN" reminder.

The `url_fw.conf` check (RISK for an active allow rule, WARN for a broad `^/OA_HTML/.*` allow, OK when none) and refused probes or non-POST requests are informational and do not change the exit code.

**Access-log format.** ASSUMPTION: OHS / Apache common or combined format with the client IP first. If OHS sits behind a load balancer, the first field is the LB; use the LB / WAF log or log `X-Forwarded-For`.

## Detection content notes

- **KQL** (`kql/oracle-ebs-hunting.kql`): **the KQL has not been run against a live tenant.** Syntax and columns follow the documented Microsoft Sentinel / Defender XDR schemas; columns marked `UNVERIFIED FIELD` and lines marked `ASSUMPTION` must be checked in your workspace. Q1 CommonSecurityLog, Q2 AzureDiagnostics (Application Gateway / WAF), Q3 Syslog (OHS / Apache access log), Q4 W3CIISLog (IIS / ARR proxies), Q5 DeviceProcessEvents, Q6 DeviceFileEvents, Q7 DeviceNetworkEvents, Q8 DeviceTvmSoftwareVulnerabilities (Defender may not inventory EBS, so an empty result proves nothing), Q9 TCF request then shell on the same host within 30 minutes. Replace the `PLACEHOLDER` host names and the `192.0.2.0/24` trusted-network placeholder.
- **Sigma** (`sigma/`): `sigma check` reports 0 errors, 0 condition errors and 0 issues for all 9 rules. All 8 detection rules convert with the kusto backend (`sigma convert -t kusto --without-pipeline`). The event-count correlation `oracle_ebs_webserver_tcf_burst.yml` does **not** convert: the kusto backend reports "Backend does not support correlation rules". Use KQL Q1-Q4 and Q9 instead, or a backend that supports correlations. Field names are the generic Sigma taxonomy; map them with your pipeline.
- **SQL** (`sql/check_patch.sql`): SELECT only. Put the patch number you confirmed in KA923 into `DEFINE fix_patch` (the shipped `00000000` is a placeholder that matches nothing).

## Corrections to the claims we were given

| Claim | Finding |
|---|---|
| Affected: Application Object Library (Core), EBS 12.2.3-12.2.15 | **Confirmed** by the Oracle CPU risk matrix, CSAF and CVE.org |
| AppsTCFServer / `oracle.apps.fnd.tcf.SocketServer`, SQL as APPS, then OS commands | **Not in Oracle's text.** Public research only; labelled as such throughout |
| CVSS 9.8, unauthenticated | **Confirmed** (Oracle, as CNA). NVD has **not** scored it (`Awaiting Analysis`); the 9.8 is Oracle's score, not NVD's |
| Exploitation attempts on the morning of 27 Oct, reported 28 Oct | **Not confirmed by Oracle or CISA.** Kept only as "public research reports exploitation attempts began on 27 Oct" (unverified by Oracle/CISA). CISA-ADP SSVC still said Exploitation "none" on 21 Oct |
| Not in KEV | **Confirmed** (catalog 2026.10.27, checked 28 Oct 2026 13:22 GMT) |
| An internet exposure count for EBS instances | **Not from a primary source; omitted** |
| A named threat actor behind an earlier EBS campaign | **Not supported by a CISA or Oracle source; omitted.** KEV only records `knownRansomwareCampaignUse` `Known` for earlier EBS CVEs, without naming an actor |
| Fix in the October 2026 CPU (20 Oct) | **Confirmed** ("Critical Patch Update", Rev 1 20 Oct 2026; a Rev 2 on 26 Oct changed credits and another product) |
| A specific patch number for 12.2 | **Not confirmed.** No patch number appears in Oracle's public CPU pages or CSAF, and KA923 needs a login, so it is not repeated here or hardcoded anywhere; use `--fix-patch` once you have confirmed your patch in KA923 |

## Still unverified

- The patch number(s) for each release (MOS Note KA923, login required) and whether the patch records bug 39800355 in `AD_BUGS`.
- The attack path, class names, SQL-as-APPS chain, `$APPLPTMP` files and OS command execution (public research only).
- Whether exploitation is happening (no Oracle or CISA confirmation as of 28 Oct 2026 13:22 GMT).
- Whether removing the TCF servlet from `url_fw.conf` breaks any Forms or Gantt features in your build.
- That `s_apps_version` in the context file stays at the base 12.2.0 after release update packs (ASSUMPTION; use `FND_PRODUCT_GROUPS.release_name`).
- All KQL column mappings marked `UNVERIFIED FIELD`; none of the KQL has been run against a live tenant.

## Running the tests

```bash
bash tests/run_tests.sh          # bash suite, shellcheck, PSScriptAnalyzer, content checks, sigma, then Pester
```

Tools are expected under `~/tools` (override with `SHELLCHECK`, `PWSH`, `SIGMA`). The bash suite also runs both checkers under `bwrap` with no network namespace and a read-only root file system and checks the output is identical, snapshots inputs before and after, and plants an executable sentinel to prove nothing found is executed. All fixtures are synthetic; log fixtures use RFC 5737 documentation IPs only.

## Limitations

- Version and patch checks rely on what you export; the checkers never query the database themselves.
- Access-log parsing assumes common / combined format; request bodies (where `GanttDataServer` would usually appear) are rarely logged.
- APPLPTMP heuristics flag scripts and binaries; some legitimate host-type concurrent programs write scripts there. Baseline first.
- The Sigma and KQL content is behavioural and will need tuning to your EBS estate.

## Sources

- Oracle Critical Patch Update Advisory, October 2026: https://www.oracle.com/security-alerts/cpuoct2026.html
- Oracle CPU October 2026, text form (risk matrix descriptions): https://www.oracle.com/security-alerts/cpuoct2026verbose.html
- Oracle CPU October 2026 CSAF: https://www.oracle.com/docs/tech/security-alerts/cpuoct2026csaf.json
- My Oracle Support Note KA923 (login required, not read): https://support.oracle.com/support/?documentId=KA923
- Oracle EBS 12.2 documentation, url_fw.conf and AutoConfig templates: https://docs.oracle.com/cd/E26401_01/doc.122/e64384/T656045T2005366.htm
- NVD CVE-2026-101767: https://nvd.nist.gov/vuln/detail/CVE-2026-101767
- CVE.org record: https://www.cve.org/CVERecord?id=CVE-2026-101767
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog and JSON feed https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json