Honeypots Recorded Probes Against Oracle E-Business Suite CVE-2026-101767 Seven Days After Its Patch, and the Finder’s Write-Up Is Dated Patch Day

Threat intelligence firm Defused says its Oracle E-Business Suite (EBS) decoys recorded exploratory exploit attempts against CVE-2026-101767 on October 27, seven days after Oracle fixed the flaw in its October 2026 Critical Patch Update. That is probing against honeypots, not a reported compromise: the alert card Defused attached to its post says the bug has “no confirmed in-the-wild exploitation yet.” The flaw needs no login, carries a CVSS 3.1 score of 9.8 and affects EBS 12.2.3 through 12.2.15, so EBS web tiers that have not applied the October patches are the place to look first.

What is established

Oracle’s CVE record describes an “Easily exploitable vulnerability” that “allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library,” and says successful attacks “can result in takeover of Oracle Application Object Library.” Oracle’s credit statement names three Horizon3.ai researchers (Brandon Peterson, Jimi Sebree and Noah King) for the report.

Horizon3 supplies the technical description. Its page calls the bug “an unauthenticated SQL injection vulnerability in Oracle E-Business Suite (EBS) that can be chained to achieve remote code execution.” An attacker who can reach the Thin Client Framework (TCF) servlet can run SQL as the APPS database user and then run operating system commands as the EBS application account, and Horizon3 says the servlet is permitted through the default EBS URL firewall configuration. Those claims are Horizon3’s; Oracle’s record does not describe the mechanism.

That is 88 days from Horizon3’s report to the fix, then seven days from the fix to the first probes Defused reported. Defused’s post adds that “No public report exists of this CVE being attempted in the wild.”

The SQL injection label comes from the finder, not from Oracle

Oracle’s record names no weakness class; it says only that attackers can “compromise” and take over the component. The CWE labels in NVD’s record, CWE-287 and CWE-306, come from the same source that supplies CISA’s SSVC data, not from Oracle. Horizon3’s page lists CWE-89 (SQL injection) and CWE-306, and Defused’s card calls the bug “unauthenticated SQLi-to-RCE.” The phrase “SQL injection” does not appear in Oracle’s description of the CVE, so that description is the finder’s.

A higher-rated flaw sits in the same update

Oracle’s EBS section says the October update contains 194 new security patches for E-Business Suite and that 31 of them “may be remotely exploitable without authentication.” By my count of the risk matrix, four rows score 9.0 or higher. All four are listed as exploitable without authentication over HTTP, and all four affect 12.2.3 through 12.2.15.

CVE-2026-101809 is the only 10.0 in the group and the only one with a changed scope. Defused reported probing for CVE-2026-101767 only, and the reports I found mention probing for no other EBS flaw in this update. Ranking by score alone would start with the 10.0, while the technical write-up and the observed probing both concern the second row, so the practical reading is to apply the whole update rather than rank within it.

An earlier EBS flaw reached CISA’s catalog about two weeks after Defused’s warning

An earlier EBS flaw Defused reported was CVE-2026-46817, an unauthenticated 9.8 in Oracle Payments. NVD published it on May 28, SecurityWeek reported on June 30 that Defused’s honeypots saw the first exploitation attempts the weekend before, and CISA added it to the KEV catalog on July 15 with a July 18 due date, 16 days after Defused’s warning. Defused said then that no public proof-of-concept existed; this time Horizon3’s page, stamped on patch day, describes the servlet and the indicators, though I found no exploit code. It is one earlier case, not a forecast.

The catalog lists four EBS entries, and three of them, including both added in October 2025, are flagged as used in ransomware campaigns. SecurityWeek recalls that the Cl0p extortion group exploited EBS zero-days last year in a campaign that potentially affected more than 100 organizations.

What to do now

1. Apply the October 2026 update. Oracle points EBS customers to My Oracle Support Note KA923 for the patch list. It adds that EBS includes Oracle Database and Oracle Fusion Middleware components whose fixes sit in separate matrices, and it “recommends that customers apply the October 2026 Critical Patch Update to the Oracle Database and Oracle Fusion Middleware components of Oracle E-Business Suite.”
2. If patching must wait, narrow the exposure. Horizon3 recommends removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restricting the web tier to trusted networks, and it adds that these measures “reduce exposure but do not replace patching.” I have not tested the mitigation.
3. Look for indicators. Horizon3 lists unauthenticated POST requests to that servlet followed by database activity, SQL reconnaissance (database version, current user, directory objects) shortly after unauthenticated web requests, and unexpected files in $APPLPTMP or the oracle account starting /bin/sh through the Concurrent Manager. Defused says its decoys saw probes aimed at the servlet’s “GanttDataServer trigger surface,” so that class name is a useful search term wherever request bodies or application logs are retained. A single probe in a log is not evidence of compromise; unexpected database queries or shell processes would be a reason to investigate.
4. Check older releases. Oracle says releases outside Premier Support or Extended Support are “not tested for the presence of vulnerabilities addressed by this Critical Patch Update” and that “it is likely that earlier versions of affected releases are also affected by these vulnerabilities.”

What is still unknown

• Who is probing, and whether any request reached a production system. Defused’s evidence comes from decoys, and its indicators sit behind its sign-up page.
• What Oracle says about this CVE. The advisory carries the standing statement that Oracle “continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” and I found no CVE-specific statement. SecurityWeek says there have been no other reports of in-the-wild exploitation.
• How closely the probes follow Horizon3’s chain. Defused calls them “exploratory” and names the same servlet and trigger class that Horizon3’s indicators list. I found no public exploit code in the sources I read, and none is linked here.
• The wording. SecurityWeek’s article calls it “the exploited flaw,” while Defused’s card says there is no confirmed exploitation yet. This post follows Defused. Horizon3 also promotes a NodeZero test for this flaw on the same page, which is worth remembering when weighing its recommendations.

Related coverage and sources

Oracle’s other enterprise suite has been in the news this year: see our coverage of June’s PeopleSoft zero-day and of the FBI’s account of a contractor’s missed patch in the ShinyHunters breach, where Reuters’ sources name Oracle PeopleSoft. For the reverse timing, see PHP2Shell, where probing began before the patch shipped.

Sources: Oracle October 2026 Critical Patch Update advisory; Oracle security alerts page; Horizon3.ai CVE-2026-101767 page; Defused on X; NVD record; CVE.org record; CISA Known Exploited Vulnerabilities catalog; SecurityWeek, October 28.