CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution

What it is

CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite 12.2.3 through 12.2.15 (CVSS 3.1 9.8, vector AV:N/AC:L/PR:N/UI:N). Horizon3.ai found it and reported it to Oracle on 24 July 2026. Oracle fixed it in the Critical Patch Update of 20 October 2026. Oracle lists the affected component as Oracle Application Object Library, Core.

How it works

A crafted request to the TCF servlet at /OA_HTML/AppsTCFServer (class oracle.apps.fnd.tcf.SocketServer) runs SQL as the APPS database user. The attack chain then gives OS command execution as the EBS application account. The default EBS URL firewall configuration already permits this endpoint, so a default install is reachable. The page does not publish the request format or payload.

Reading or changing APPS-accessible data is possible, which can include financial, payroll, HR and procurement records. OS-level reach depends on what the EBS account can do.

Preconditions / Affected

• Network access over HTTP or HTTPS to the EBS web tier. No credentials or user interaction.
• Internet-facing web tiers are the most direct exposure. Internal deployments are at risk if an attacker can reach the servlet from a compromised host or another segment.

What to do

1. Apply the October 2026 CPU patches that match your installation. The page points to the patch availability documentation in the Oracle advisory and My Oracle Support Note KA923.
2. Until patched, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist.
3. Restrict web tier access to trusted networks, on every untrusted path to the servlet.
4. Hunt for compromise on the application host and database, using the indicators below.

Indicators of compromise listed by the page:

• Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.
• SQL reconnaissance soon after unauthenticated web requests: database version, current user, directory objects.
• Unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through the Concurrent Manager to run OS commands.

Caveats

• The page says the allowlist and network restrictions reduce exposure but do not replace patching.
• Horizon3 notified its Rapid Response customers after the July disclosure. The page does not say whether exploitation in the wild has been seen.
• The page promotes a NodeZero Rapid Response test to check exploitability before and after patching. It gives no independent test method.