CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the Wild

What it is

CVE-2026-101767 (CVSS 9.8) is an unauthenticated SQL injection in the Thin Client Framework servlet of Oracle E-Business Suite's Application Object Library. Horizon3.ai reported it to Oracle on 24 July 2026, and Oracle fixed it in the Critical Patch Update released 20 October 2026.

How it works

The servlet at /OA_HTML/AppsTCFServer lacks authentication on a critical function and does not sanitize input properly. A crafted POST request that instantiates oracle.apps.jtf.gantt.server.GanttDataServer runs arbitrary SQL as the privileged APPS database user. From there an attacker can chain to OS command execution as the EBS application account.

Preconditions / Affected

• Application Object Library 12.2.3 through 12.2.15. Oracle says earlier unsupported versions are likely affected too.
• The servlet passes through the default EBS URL firewall configuration, so any internet-facing instance with default settings is exposed.
• No authentication is needed.

What to do

1. Apply the October 2026 Critical Patch Update (My Oracle Support Note KA923).
2. Patch the EBS Database and Fusion Middleware components as well. They have separate CPU entries, so the EBS patch alone does not cover them.
3. Until patched, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
4. Also until patched, restrict network access to the EBS web tier to trusted networks.

Caveats

• Horizon3.ai has published technical details of the attack chain. Defused saw exploratory attempts on EBS honeypots on 27 October 2026, one week after the patch.
• As of the page's writing, the CVE was not on CISA's Known Exploited Vulnerabilities catalog.
• The page cites the Cl0p group's large-scale EBS campaign the previous year as evidence that financially motivated actors target EBS. It does not tie any actor to this CVE.
• The page gives no detection queries, indicators of compromise, or request samples. The last section is Orca product promotion.