Attackers are scanning for a critical, newly patched flaw in Oracle E-Business Suite days after the fix shipped.
SecurityWeek reports that threat intelligence firm Defused has observed attackers probing for CVE-2026-101767, a critical flaw in Oracle E-Business Suite with a CVSS score of 9.8. Discovered by Horizon3.ai, the bug is an unauthenticated SQL injection that can be chained to remote code execution by sending a crafted request to the vulnerable TCF servlet, letting an attacker run SQL with the privileges of the APPS database user. Oracle shipped a fix on October 20 as part of its October Critical Security Patch Update, and the first exploratory probing attempts were recorded on October 27, just a week later.
Oracle has not yet confirmed exploitation in the wild, and SecurityWeek notes there are no other reports of active attacks so far beyond the probing activity. Shadowserver separately tracks hundreds of internet-exposed Oracle EBS instances, most with US IP addresses. Horizon3.ai recommends removing the vulnerable servlet path from URL firewall allowlists, restricting web-tier access to trusted networks, and monitoring affected hosts and databases for signs of compromise.
Why it matters: Oracle E-Business Suite has been a repeated target for data-theft campaigns, and the gap between patch and proof-of-concept exploitation keeps shrinking. Enterprises running EBS should treat October's CPU as urgent, not routine, and tighten web-tier access while patching rolls out.