Attackers scan for unpatched Oracle E-Business Suite systems with critical flaw

Attackers have started combing the internet for Oracle E-Business Suite (EBS) systems that remain unpatched against a recently disclosed critical vulnerability.

The flaw, tracked as CVE-2026-101767, resides in a core EBS component, the Application Object Library. It allows an unauthenticated attacker with HTTP network access to take over a vulnerable system, and the attack complexity is rated as low.

Oracle released a fix on October 20 as part of its October Critical Security Patch Update and urged customers to apply it immediately. "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches," the company said, strongly recommending that customers stay on actively supported versions and install security patches without delay.

First exploitation attempts

Oracle itself has not yet flagged CVE-2026-101767 as exploited in the wild. However, threat intelligence firm Defused reported on Tuesday that it is already seeing scans for vulnerable systems.

"Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27," Defused warned.

Internet watchdog Shadowserver tracks more than 670 internet-exposed Oracle EBS instances, most of them with US IP addresses. It does not, however, indicate how many are honeypots or have already been secured against the flaw.

Oracle as an attractive target

Oracle vulnerabilities are popular with attackers because they open a path into enterprise systems at many Fortune 100 companies, government organizations and healthcare networks worldwide.

Since early August 2025, for example, the Clop extortion gang has exploited another Oracle EBS flaw (CVE-2025-61882) in zero-day attacks. Victims include Logitech, GlobalLogic, The Washington Post and several US universities, among them Harvard, the University of Pennsylvania, Dartmouth College and the University of Phoenix.

In June, Oracle released emergency mitigations for a critical PeopleSoft Suite zero-day (CVE-2026-35273) that the ShinyHunters gang exploited between May 27 and June 9. The flaw gave attackers unauthenticated remote code execution, and they stole data from many organizations, including Nottingham University, Nissan and the National Association of Insurance Commissioners (NAIC).

Since November 2021, the US agency CISA has added 46 Oracle security bugs to its catalog of actively exploited vulnerabilities, 13 of which have also been used in ransomware attacks.

Source: Bleeping Computer