CriticalAttempts reportedUnauthenticatedOracle E-Business Suite

Is your Oracle E-Business Suite exposed to CVE-2026-101767?

CVE-2026-101767 is a flaw in Oracle E-Business Suite 12.2.3 to 12.2.15 that needs no login and is exploitable over HTTP. Oracle fixed it in the October 2026 Critical Patch Update on 20 October. Security researchers describe it as SQL injection leading to code execution and report exploitation attempts from 27 October. No breaches are confirmed yet.

Not in CISA KEV, attempts reported

CVE-2026-101767 is not in CISA's Known Exploited Vulnerabilities catalogue (release 2026.10.27), so there is no CISA due date. Security researchers reported exploitation attempts from 27 October 2026. Oracle and CISA have not confirmed exploitation and no breaches are confirmed yet. Do not wait for a KEV listing: apply the October 2026 CPU now.

By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 28 October 2026, 13:55 GMT.

Check Exposure How to Hunt

At a Glance

Based on Oracle, CISA and NVD as of 28 October 2026. Last updated 28 October 2026, 13:55 GMT.

Severity

CVSS 9.8 Critical

Scored by Oracle (CVSS 3.1). NVD lists it as Awaiting Analysis and has not scored it yet.

Status

Not in KEV, attempts reported

Security researchers report exploitation attempts from 27 October 2026. Not confirmed by Oracle or CISA.

Exposure

EBS 12.2.3 to 12.2.15

Oracle Application Object Library (Core). No login needed, exploitable over HTTP.

Fix

October 2026 CPU

Patches for your release in My Oracle Support note KA923 (Oracle bug 39800355).

20 Oct

Oracle releases the October 2026 Critical Patch Update with the fix. NVD publishes CVE-2026-101767 the same day.

26 Oct

Oracle publishes revision 2 of the CPU. It changes only the credits and Siebel entries, nothing for this flaw.

27 Oct

Security researchers see exploitation attempts against internet-facing EBS systems (public research).

28 Oct

The attempts are reported publicly. No breaches are confirmed and it is not in CISA KEV.

Affected and fixed versions

Release	Status	Fix
Oracle E-Business Suite 12.2.3 to 12.2.15	Affected (Application Object Library, Core)	October 2026 CPU patches for your release, listed in My Oracle Support note KA923 (Oracle bug 39800355)
Oracle E-Business Suite 12.2.16 and later	Not listed by Oracle	Confirm in KA923 that your level includes the October 2026 CPU content
Oracle E-Business Suite 12.2.0 to 12.2.2	Below the CPU baseline, no patch offered	Upgrade to a supported 12.2 level, then apply the CPU
Oracle E-Business Suite 12.1 and earlier	Not assessed by Oracle	Treat as exposed, restrict access and plan an upgrade

Oracle's public pages give the bug number 39800355 but not the patch numbers. The patches for each release are in My Oracle Support note KA923, which needs a login.

What is confirmed, and what comes from public research

Confirmed by Oracle: a flaw in Oracle Application Object Library (Core) in EBS 12.2.3 to 12.2.15, exploitable over HTTP with no login, CVSS 3.1 9.8. Oracle says a successful attack can result in takeover of Oracle Application Object Library. The fix is in the October 2026 CPU.
From public research only: security researchers report that the entry point is the Thin Client Framework servlet /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer), which the default url_fw.conf allowlist permits. Unauthenticated POSTs load GanttDataServer, leading to SQL injection running as the APPS database user, files written to $APPLPTMP and operating system commands run through the Concurrent Manager. Oracle has not described the mechanism.
Exploitation: security researchers report attempts from 27 October 2026, reported publicly on 28 October. No breaches are confirmed yet, and Oracle and CISA have not confirmed exploitation.

The detection pack keys on the public research behaviour because it is what shows up in logs, and also looks for generic signs such as shells spawned by the oracle account, so it does not depend on the exact technique.

Apply the whole EBS update: CVE-2026-101809

The same CPU fixes CVE-2026-101809 in Oracle Workflow (Notification Mailer), which Oracle scores CVSS 10.0 and which also needs no login. Oracle's EBS section of the October 2026 CPU has 194 new security patches, 31 of them remotely exploitable without authentication. Apply the whole EBS CPU, not just one fix.

What to Do in the Next 24 Hours

Proactive on the left. Reactive on the right. Tick both tracks.

Proactive

Patch and restrict

Find every EBS 12.2.x instance, including DR, test and cloned ones.
Apply the October 2026 CPU from KA923, internet-facing instances first.
Until then, remove AppsTCFServer from url_fw.conf through the AutoConfig template.
Limit the EBS web tier to trusted networks or a VPN.

Reactive

Hunt and contain

Look for unauthenticated POSTs to /OA_HTML/AppsTCFServer.
Check for SQL recon by APPS right after those requests.
Look for unexpected files in $APPLPTMP and the oracle account spawning /bin/sh.
If you find any, isolate the host, keep the logs and rotate APPS and other credentials.

Proactive: Check Exposure and Patch

Apply the October 2026 CPU first. Until you can, close the reported entry point and keep the web tier off the open internet.

Step 1

Find every EBS 12.2.x instance

List production, DR, test and cloned environments, internet-facing and internal. For each, read the release from FND_PRODUCT_GROUPS.release_name and export the applied patches with the read-only SQL in the pack, then run the free checkers below.

Step 2

Apply the October 2026 CPU

Install the October 2026 CPU patches and prerequisites for your release from My Oracle Support note KA923, internet-facing instances first. Releases 12.2.0 to 12.2.2 need an upgrade first. Apply the whole EBS CPU so CVE-2026-101809 is fixed too. See the Oracle CPU advisory.

Step 3

Remove AppsTCFServer from url_fw.conf

Until an instance is updated, comment out the allow rule for the AppsTCFServer servlet in the EBS URL firewall allowlist. Edit the AutoConfig custom template and rerun AutoConfig, or AutoConfig will put the rule back. Some Forms or Gantt features may rely on the servlet, so test on a clone first.

# Edit the AutoConfig template, not just the generated file
cp $FND_TOP/admin/template/url_fw_conf_FMW.tmp \
   $FND_TOP/admin/template/custom/

# In the custom copy, comment out the allow rule(s) for
#   AppsTCFServer (oracle.apps.fnd.tcf.SocketServer)

# Rerun AutoConfig on each application tier node, then confirm
# (use a copy of the generated url_fw.conf from the OHS config directory)
bash check-oracle-ebs.sh --url-fw ./url_fw.conf

Step 4

Limit the web tier to trusted networks

Restrict Oracle HTTP Server, the load balancer and the WAF to your user and admin networks. If suppliers or remote staff need access, put it behind a VPN or an authenticated reverse proxy. Block POSTs to /OA_HTML/AppsTCFServer from anywhere else at the WAF.

Step 5

Do not skip internal instances

An internal-only EBS is one compromised laptop, VPN account or supplier connection away. Update internal, DR and test instances in the same cycle as the internet-facing ones.

Step 6

Turn on and keep the logs

Keep OHS access logs with method and status, load balancer and WAF logs, WebLogic logs, database audit and endpoint telemetry on the application and database tiers, and forward them to your SIEM so the hunts below can run.

Free Detection Pack

Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check each instance's patch status and hunt for signs of exploitation. Everything is read-only.

Linux and macOS

check-oracle-ebs.sh

Reads the release, the applied patch list, the generated url_fw.conf, OHS access logs and $APPLPTMP that you export or point it at, and reports a verdict. Add --fix-patch once you have confirmed your patch number in KA923.

bash check-oracle-ebs.sh \
  --release 12.2.12 \
  --context-file ./EBS_apphost.xml \
  --patch-list ./ad_bugs.csv \
  --url-fw ./url_fw.conf \
  --access-log ./access_log \
  --trusted 192.0.2.0/24 \
  --applptmp /usr/tmp

Download check-oracle-ebs.sh

Windows

Check-OracleEbs.ps1

The same checks in PowerShell 7, with the same output and exit codes. It also runs under PowerShell on Linux.

pwsh -File Check-OracleEbs.ps1 -Release 12.2.12 -ContextFile .\ctx.xml `
  -PatchList .\ad_bugs.csv -UrlFw .\url_fw.conf `
  -AccessLog .\access_log -Trusted 192.0.2.0/24 -Applptmp /usr/tmp

Download Check-OracleEbs.ps1 (.zip)

Hunting queries

SQL, KQL and Sigma

Read-only SQL to export the release and applied patches, plus optional hunts for host concurrent programs and directory objects. 9 KQL queries for Microsoft Sentinel and Defender XDR covering WAF, Application Gateway, OHS and IIS logs, processes, files and network. 9 Sigma rules cover the same ground for other SIEM platforms.

Download SQL Download KQL (.zip)Download Sigma (.zip)

Verdicts

PATCHED12.2.3 to 12.2.15 with the fix patch you confirmed in KA923 in the patch list, or 12.2.16 and later, and no indicators found.
LIKELY VULNERABLEThe confirmed fix patch is missing, a patch list without Oracle bug 39800355, or 12.2.0 to 12.2.2.
UNKNOWNNo release given, no patch list, or no confirmed patch number to check against. Also 12.1 and earlier, which Oracle did not assess.
INDICATORS FOUNDA served POST to AppsTCFServer from outside your trusted networks, a request naming GanttDataServer or a suspicious file in $APPLPTMP. This overrides PATCHED.

Exit codes

Code	Meaning
0	PATCHED
1	LIKELY VULNERABLE, or INDICATORS FOUND
2	UNKNOWN
3	Error, such as no inputs or an unreadable file

MSPs can use the exit code in RMM or scheduled jobs to flag instances at scale. The url_fw.conf result (RISK, WARN or OK) is informational and does not change it.

Know the limits

Both checkers are read-only and offline. They only read the files you give them, never connect to EBS, the database or any URL, never send a request to AppsTCFServer and never run a file they find.
Oracle's public pages give no patch number, so the checkers do not hardcode one. Without a number you confirmed in KA923 the patch result is UNKNOWN, not PATCHED.
Request bodies are rarely logged, so not finding GanttDataServer in logs is weak evidence.
The KQL has not been run against a live tenant. Fields marked UNVERIFIED FIELD depend on your connectors, and the Sigma burst correlation rule does not convert to KQL. Use KQL Q1 to Q4 and Q9 for that.

Download the Full Pack (.zip)README

Reactive: How to Hunt

An instance that ran without the October 2026 CPU may already have been reached. Hunt over the whole unpatched period, at least from 20 October 2026. CybaOps can run these hunts across your estate or your clients'.

Hunt 1

Unauthenticated POSTs to AppsTCFServer

Look for POST requests to /OA_HTML/AppsTCFServer that were served (2xx) from outside your user networks, especially bursts from one IP (checker --access-log, KQL Q1 to Q4 and the Sigma webserver rules).

Hunt 2

GanttDataServer followed by database activity

Look for any request or WebLogic log entry naming GanttDataServer outside normal Gantt use, followed by database activity from the APPS session pool. Request bodies are rarely logged, so not finding it proves little.

Hunt 3

SQL recon right after web requests

In database audit or ASH data, look for APPS sessions querying the database version, the current user or directory objects (ALL_DIRECTORIES, DBA_DIRECTORIES), or creating directory objects, shortly after an unauthenticated web request (hunts H5 and H6 in the SQL file).

Hunt 4

Unexpected files in $APPLPTMP

Check $APPLPTMP and OA_HTML for scripts, JSPs, classes, JARs, binaries, executable files or symlinks you cannot explain (checker --applptmp, KQL Q6 and the Sigma file rules). Baseline first, as some host concurrent programs write scripts there.

Hunt 5

The oracle account spawning /bin/sh

Look for /bin/sh or download and recon tools started by the oracle or applmgr account through the Concurrent Manager (FNDLIBR), the web tier JVM or the database, and for new or changed host concurrent programs (KQL Q5 and Q9, SQL hunts H1 to H3).

Hunt 6

Unusual outbound connections

Check for new outbound connections from the application and database tiers, such as downloads or callbacks to hosts you do not use (KQL Q7).

If you find something

Isolate the host at the network level. Do not wipe it.
Keep the evidence: OHS, load balancer and WAF logs, WebLogic logs, concurrent manager logs, database audit trails and a disk and memory image.
Rotate the APPS, SYSADMIN, APPLSYS, SYSTEM and SYS passwords, the WebLogic admin password and any integration or service account whose credentials EBS stores.
Treat the EBS data (finance, HR, suppliers and customers) as possibly exposed, and involve your legal team and DPO on breach notification.
Apply the CPU, rebuild from a known good state where you can, and keep monitoring.

Patched does not mean clean

The October 2026 CPU closes the flaw, but it does not remove files, changed concurrent programs, new accounts or stolen credentials an attacker already has. Every instance that ran an affected release should be hunted, not just updated.

Oracle EBS CVE-2026-101767 FAQ

Short answers based on Oracle, CISA and NVD as of 28 October 2026.

Is CVE-2026-101767 being exploited?

Security researchers report exploitation attempts against internet-facing Oracle E-Business Suite systems from 27 October 2026, reported publicly on 28 October. No breaches are confirmed yet, and neither Oracle nor CISA has confirmed exploitation. Treat any unpatched, reachable instance as a target now.

Is it in the CISA KEV catalogue?

No. CVE-2026-101767 was not in CISA's Known Exploited Vulnerabilities catalogue as of the 27 October 2026 release, so there is no CISA due date. That only means CISA has not confirmed exploitation yet. It is not a reason to wait.

Which versions are affected?

Oracle lists Oracle E-Business Suite 12.2.3 to 12.2.15, in Oracle Application Object Library (component Core). Releases 12.2.0 to 12.2.2 get no CPU patch and need an upgrade. For 12.2.16 and later, confirm in My Oracle Support note KA923. Treat 12.1 and earlier as exposed.

How severe is it?

Oracle scores it CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It needs no login and works over HTTP, and Oracle says a successful attack can result in takeover of Oracle Application Object Library. NVD has not scored it yet and lists it as Awaiting Analysis.

How do we fix it?

Apply the October 2026 Critical Patch Update for Oracle E-Business Suite and its prerequisites, as listed for your release in My Oracle Support note KA923, internet-facing instances first. Oracle's public pages give the bug number 39800355 but not the patch numbers, so confirm the exact patches in KA923.

What is CVE-2026-101809, and do we need a separate fix?

CVE-2026-101809 is a separate flaw in Oracle Workflow (Notification Mailer) fixed in the same October 2026 CPU. Oracle scores it CVSS 10.0 and it also needs no login. Apply the whole EBS CPU, not just the fix for CVE-2026-101767, and both are covered.

What can we do before we can apply the CPU?

Remove the AppsTCFServer rule from the EBS URL firewall allowlist (url_fw.conf) through the AutoConfig custom template, and limit the EBS web tier to trusted networks or a VPN. Test on a clone first, as some Forms or Gantt features may rely on the servlet. These steps reduce risk but do not replace the CPU.

Does applying the CPU remove an attacker who is already in?

No. The CPU closes the flaw but leaves anything an attacker already planted, such as files in $APPLPTMP, changed concurrent programs or stolen credentials. Hunt over the whole period each instance ran without the CPU, at least from 20 October 2026.

Our EBS is internal only. Can we wait?

No. Internal instances are reachable from any compromised laptop, VPN account or supplier connection. Patch internet-facing instances first, then internal, DR, test and cloned environments in the same cycle.

We are an MSP or run several EBS estates. Where do we start?

Export the release and applied patch list from each instance with the read-only SQL in the pack and run the free checkers against them. Use the exit codes to flag LIKELY VULNERABLE and UNKNOWN instances, apply the URL firewall change on those first, and treat any INDICATORS FOUND result as an incident.

Protect Your ERP, and Your Clients'

CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.

Book a CybaOps demo