Oracle patched a 9.8 EBS flaw in October. Decoys saw exploit attempts on the 27th.
By Lior AharonovFounder, 7IT Solutions ·
What happened
Oracle fixed CVE-2026-101767, an unauthenticated SQL injection in the Application Object Library of E-Business Suite rated CVSS 9.8, in its October critical patch update. Defused says its decoys recorded exploratory exploits against it on 27 October. SecurityWeek notes there are no other reports of in-the-wild exploitation.
Why it matters
A flaw that needs no login and can lead to remote code execution is a takeover button on the system that runs your orders and invoices. SecurityWeek recalls that the Cl0p group exploited Oracle zero-days last year.
What to do
If you run Oracle E-Business Suite, apply the October 2026 critical patch update now and take the web tier off the open internet where you can.
My take
Lior Aharonov
Founder, 7IT Solutions
Probing is the polite word for the first knock. The second one usually carries a payload.
Sources
| SecurityWeek: Hackers Start Probing Fresh Oracle EBS Vulnerability | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.