Internet-based reconnaissance for a newly disclosed critical vulnerability in Oracle E-Business Suite has begun, with threat actors probing for unpatched installations across the web. The flaw, designated CVE-2026-101767 and residing in the Application Object Library component, permits unauthenticated attackers with HTTP access to compromise affected systems through straightforward attack methods.
Oracle distributed fixes for the vulnerability as part of its October 2026 Critical Security Patch Update on October 20, simultaneously issuing an urgent call for immediate patching. The company stated: "In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay."
Although Oracle has not yet marked CVE-2026-101767 as exploited in active attacks, threat intelligence firm Defused identified scanning activity targeting the vulnerability. The company reported: "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution, this morning, Oct 27."
Shadowserver, an Internet monitoring organization, has catalogued more than 670 publicly accessible Oracle EBS instances, with the majority located in the United States. The organization has not disclosed what proportion of these systems are protected against the CVE-2026-101767 vulnerability or serve as monitoring decoys.
Oracle vulnerabilities remain attractive targets for attackers seeking to infiltrate enterprise networks within Fortune 100 companies, public sector agencies, and healthcare systems globally. The company's software components are widely deployed across critical sectors, making them high-value targets for extortion operations.
The Clop extortion operation has been leveraging a separate Oracle EBS vulnerability, CVE-2025-61882, since early August 2025 in zero-day attacks. Victims have included Logitech, GlobalLogic, the Washington Post, and multiple universities such as Harvard University, the University of Pennsylvania, Dartmouth College, and the University of Phoenix.
In June, Oracle released emergency mitigations for CVE-2026-35273, a critical zero-day in PeopleSoft Suite that the ShinyHunters extortion group exploited between May 27 and June 9. The attackers used the flaw to obtain unauthenticated remote code execution and exfiltrate data from organizations including Nottingham University, Nissan, and the National Association of Insurance Commissioners (NAIC).
Since November 2021, the Cybersecurity and Infrastructure Security Agency (CISA) has documented 46 Oracle security flaws on its catalog of actively exploited vulnerabilities. Of these, 13 have been weaponized in ransomware campaigns.