{"id":3521,"date":"2026-10-28T12:17:52","date_gmt":"2026-10-28T19:17:52","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=3521"},"modified":"2026-10-30T13:19:25","modified_gmt":"2026-10-30T20:19:25","slug":"cve-2026-101767-oracle-ebs-vulnerability","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/cve-2026-101767-oracle-ebs-vulnerability\/","title":{"rendered":"CVE-2026-101767\u00a0: Une faille dans Oracle E-Business Suite permet \u00e0 une seule requ\u00eate HTTP d\u2019atteindre la base de donn\u00e9es et l\u2019h\u00f4te."},"content":{"rendered":"

MAG212 CYBER | Critical CVEs | October 28, 2026<\/strong><\/p>\n\n\n\n

CVE-2026-101767<\/strong> is a critical, unauthenticated vulnerability in Oracle E-Business Suite (EBS)<\/strong>, the ERP platform many organizations use for finance, HR, procurement and payments. Horizon3.ai, which discovered it, shows how a request to a default-allowed servlet reaches the database as the powerful APPS<\/strong> schema and then chains to operating-system commands. Oracle fixed it in the October 2026 Critical Patch Update<\/strong> on 20 October. Exploitation attempts against honeypots began two days later.<\/p>\n\n\n\n

Key facts<\/h2>\n\n\n\n
Item<\/th>Detail<\/th><\/tr><\/thead>
CVE<\/strong><\/td>CVE-2026-101767<\/td><\/tr>
Product<\/strong><\/td>Oracle E-Business Suite, Application Object Library (Core)<\/td><\/tr>
Gravit\u00e9<\/strong><\/td>CVSS 3.1 9.8<\/strong> Critical (AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/code>)<\/td><\/tr>
Weakness<\/strong><\/td>CWE-89 + CWE-306 per Horizon3.ai; CWE-287 + CWE-306 per CVE trackers<\/td><\/tr>
Authentication<\/strong><\/td>None required<\/td><\/tr>
Affected<\/strong><\/td>EBS 12.2.3 through 12.2.15<\/td><\/tr>
Fixed<\/strong><\/td>October 2026 Critical Patch Update (20 Oct; revised 26 Oct)<\/td><\/tr>
Exploitation<\/strong><\/td>Attempts observed from 22 Oct 2026; no confirmed compromises reported<\/td><\/tr>
CISA KEV<\/strong><\/td>Not listed as of 28 Oct 2026<\/td><\/tr>
Credit<\/strong><\/td>Brandon Peterson, Jimi Sebree and Noah King (Horizon3.ai)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Oracle’s own advisory text describes the flaw as allowing takeover and does not use the words “SQL injection”; that characterization comes from Horizon3.ai’s research.<\/p>\n\n\n\n

How the attack works<\/h2>\n\n\n\n
\"Oracle<\/a>
The chain described by Horizon3.ai. No exploit payload has been published by the researchers.<\/figcaption><\/figure>\n\n\n\n
    \n
  1. Web tier.<\/strong> An unauthenticated POST reaches \/OA_HTML\/AppsTCFServer<\/code>, the Thin Client Framework socket servlet (oracle.apps.fnd.tcf.SocketServer<\/code>). It is allowed by EBS’s default URL firewall.<\/li>\n\n\n\n
  2. TCF.<\/strong> The request invokes the Gantt data server (oracle.apps.jtf.gantt.server.GanttDataServer<\/code>).<\/li>\n\n\n\n
  3. Database.<\/strong> The attacker executes SQL as APPS<\/strong>, the schema that owns EBS’s business data, and typically starts with reconnaissance: database version, current user, directory objects.<\/li>\n\n\n\n
  4. Host.<\/strong> The chain extends to OS command execution as the EBS application account (the oracle<\/code> user in Horizon3’s indicators), for example a shell spawned through the Concurrent Manager.<\/li>\n<\/ol>\n\n\n\n

    OS execution as the oracle<\/code> user is not automatic root access. But APPS can read and change financial, HR, supplier and payment records, which usually matters far more than the server itself.<\/p>\n\n\n\n

    Why EBS flaws get exploited fast<\/h2>\n\n\n\n

    Oracle EBS has a recent history of mass exploitation. In 2025, CVE-2025-61882<\/strong> (CVSS 9.8) was used in the Cl0p data-extortion campaign, which later reporting tied to more than 100 organizations. In June 2026, CVE-2026-46817<\/strong> in Oracle Payments was exploited and added to KEV. Shadowserver counted about 950 internet-exposed EBS instances<\/strong> on 1 July 2026.<\/p>\n\n\n\n

    For CVE-2026-101767, Previdian’s sensors logged the first exploitation attempt at 17:28 UTC on 22 October: eight attempts from five IP addresses in five countries over the following week, six of them on 27 October. Defused reported exploratory hits on its EBS decoys on 27 October. Two GitHub repositories claiming to be proofs of concept appeared on 26 October; both are unverified and may contain malware. Do not run them.<\/strong><\/p>\n\n\n\n

    How to fix and harden<\/h2>\n\n\n\n
      \n
    1. Apply the October 2026 Critical Patch Update<\/strong> for your EBS release, following Oracle’s patch availability document. Use your normal online patching (adop) cycle and record the patch IDs and cycle results.<\/li>\n\n\n\n
    2. Remove AppsTCFServer from the URL firewall allowlist<\/strong> and restrict the EBS web tier to trusted networks, as Horizon3.ai recommends. Do this now, even before patching. Check first whether any features you use (such as Gantt views) depend on TCF.<\/li>\n\n\n\n
    3. Close every route.<\/strong> Map load balancers, reverse proxies, partner VPNs and disaster-recovery nodes. An edge block is incomplete if a partner network or compromised workstation can still reach an origin server.<\/li>\n\n\n\n
    4. Retest<\/strong> with an approved, non-destructive method after patching, and keep restrictions in place until the application owner accepts the residual risk.<\/li>\n<\/ol>\n\n\n\n

      A simple edge rule while you patch:<\/p>\n\n\n\n

      # reverse proxy: deny the TCF servlet\nlocation ~* ^\/OA_HTML\/AppsTCFServer {\n    deny all;\n}<\/code><\/pre>\n\n\n\n
      How to hunt for CVE-2026-101767 activity<\/h2>\n\n\n\n
      Preserve evidence before you clean anything: OHS and web access logs, proxy and WAF logs, database audit records and endpoint telemetry. Record clock offsets between systems. On 12.2, collect the Oracle HTTP Server logs under the instance home. Don’t delete files in $APPLPTMP<\/code> before responders image them.<\/p>\n\n\n\n
      Layer<\/th>What to look for<\/th><\/tr><\/thead>
      Web<\/td>Unauthenticated POSTs to \/OA_HTML\/AppsTCFServer<\/code> invoking GanttDataServer<\/code><\/td><\/tr>
      Database<\/td>Reconnaissance soon after: v$version<\/code>, current user, all_directories<\/code><\/td><\/tr>
      Filesystem<\/td>Unexpected files in $APPLPTMP<\/code><\/td><\/tr>
      Process<\/td>Le oracle<\/code> account spawning \/bin\/sh<\/code> through the Concurrent Manager<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      A quick read-only search of an exported log:<\/p>\n\n\n\n
      rg -n \"AppsTCFServer\" \/path\/to\/exported-access.log\nrg -n \"POST .*AppsTCFServer\" \/path\/to\/*.log | \\\n  awk '{print $1}' | sort | uniq -c | sort -rn<\/code><\/pre>\n\n\n\n
      A match is a lead, not proof of compromise. No match is not a clean bill of health if your logs are incomplete. Correlate web requests with database sessions and process activity in a narrow time window.<\/p>\n\n\n\n
      Frequently asked questions<\/h2>\n\n\n\n
      Which Oracle EBS versions are affected by CVE-2026-101767?<\/h3>\n\n\n\n
      Oracle E-Business Suite 12.2.3 through 12.2.15. The fix is in the October 2026 Critical Patch Update.<\/p>\n\n\n\n
      Is CVE-2026-101767 being exploited?<\/h3>\n\n\n\n
      Exploitation attempts have been observed since 22 October 2026, but no confirmed compromises had been reported as of 28 October, and the flaw was not yet in CISA’s KEV catalog.<\/p>\n\n\n\n
      Does blocking the URL fix the vulnerability?<\/h3>\n\n\n\n
      No. Blocking \/OA_HTML\/AppsTCFServer<\/code> reduces exposure while you patch, but only the Critical Patch Update fixes the flaw. Make sure every route to the application is covered.<\/p>\n\n\n\n
      Is there a public exploit?<\/h3>\n\n\n\n
      Researchers have not published a payload. Repositories claiming to be exploits appeared on 26 October but are unverified and may be malicious.<\/p>\n\n\n\n
      Sources<\/h2>\n\n\n\n