Oracle has fixed the critical vulnerability CVE-2026-101767 (CVSS 9.8) in the Oracle Application Object Library component of Oracle E-Business Suite as part of the October 2026 Critical Patch Update. The vulnerability is an unauthenticated SQL injection that, according to researchers from Horizon3.ai, can be chained to achieve remote code execution. Versions of EBS from 12.2.3 through 12.2.15 inclusive are affected. Organizations using Oracle E-Business Suite with a network-accessible web tier must apply the patch or immediately restrict access to the vulnerable servlet.
Technical details of the vulnerability
According to Oracle’s risk matrix, CVE-2026-101767 has a maximum criticality profile: the attack vector is network (HTTP/HTTPS), exploitation complexity is low, and neither authentication nor user interaction is required. The impact on confidentiality, integrity, and availability is rated as high.
According to Horizon3.ai’s research, the vulnerability resides in the Thin Client Framework (TCF) servlet, available at the path /OA_HTML/AppsTCFServer and implemented by the oracle.apps.fnd.tcf.SocketServer class. An attacker with network access to this endpoint can execute SQL queries with the privileges of the APPS database user and then execute operating system commands with the privileges of the EBS application account.
Successful exploitation allows reading and modifying data accessible to the APPS user. Depending on the specific deployment, Horizon3.ai estimates that financial records, payroll data, HR information, and procurement data may be at risk. The level of access to the operating system is determined by the privileges of the compromised EBS application account.
The vulnerability was discovered by Brandon Peterson, Jimi Sebree, and Noah King from Horizon3.ai and, according to them, was reported to Oracle on July 24, 2026. The patch was released on October 20, 2026.
Threat scale and context
The highest risk affects EBS deployments whose web tier is accessible from the internet. However, as Horizon3.ai notes, internal EBS systems are also vulnerable if an attacker can reach the TCF servlet from an already compromised host or an accessible network segment. This extends the attack surface beyond the perimeter — a single entry point into the internal network is enough.
At the time of publication, CVE-2026-101767 has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. At the same time, two other critical Oracle EBS vulnerabilities — CVE-2025-61882 and CVE-2026-46817 (both with CVSS 9.8) — are already in the KEV catalog, confirming their active exploitation. According to an Oracle advisory, CVE-2025-61882 is also an unauthenticated remote code execution vulnerability affecting versions 12.2.3–12.2.14. CVE-2026-46817 affects the Oracle Payments (File Transmission) component in versions 12.2.3–12.2.15, according to the May Oracle update.
Oracle products have repeatedly been targeted in attacks — we have already written about the CISA-confirmed exploitation of a vulnerability in Oracle WebLogic. The emergence of a third critical EBS vulnerability in a year underscores the systemic nature of risks in this product line.
Indicators of compromise
Horizon3.ai has published the following indicators that should be monitored:
- Unauthenticated POST requests to
/OA_HTML/AppsTCFServerinstantiating theoracle.apps.jtf.gantt.server.GanttDataServerclass, followed by database activity - SQL reconnaissance shortly after unauthenticated web requests (queries for the database version, current user, and directory objects)
- Unexpected files in the
$APPLPTMPdirectory and a/bin/shprocess spawned by the oracle account via Concurrent Manager to execute OS commands
Recommendations for protection
The top priority is to apply the patch from Oracle’s October 2026 Critical Patch Update. If immediate patch installation is not possible, Horizon3.ai recommends the following temporary measures:
- Remove
/OA_HTML/AppsTCFServer(associated withoracle.apps.fnd.tcf.SocketServer) from the list of allowed URLs in the EBS firewall - Restrict access to the EBS web tier to trusted networks only
- Set up monitoring of the EBS application host and database for signs of compromise using the indicators described above
Horizon3.ai stresses that these measures reduce risk but do not replace installing the patch.
Given that the two previous critical EBS vulnerabilities have already been confirmed as actively exploited and added to the CISA KEV catalog, the window for safely postponing the CVE-2026-101767 patch is extremely small. Organizations running Oracle EBS versions 12.2.3–12.2.15 should treat deployment of the October update as a top-priority task and, until it is applied, immediately block access to the /OA_HTML/AppsTCFServer servlet from all untrusted network segments.
