Oracle E-Business Suite Vulnerability: Critical Flaw, Patch Now

Oracle has patched a critical, pre-authentication SQL-injection flaw in E-Business Suite (EBS) that can be chained to remote code execution, and a second EBS flaw with the maximum possible severity score. The first, CVE-2026-101767, carries a CVSS base score of 9.8 and sits in the Application Object Library "Core" component; the second, CVE-2026-101809, scores a perfect 10.0 in the Workflow Notification Mailer. Both were fixed in Oracle's October 2026 Critical Patch Update (CPU), released October 20, 2026, and both are reachable over plain HTTP by an attacker with no credentials and no user interaction. Oracle's own risk matrix lists both as affecting EBS 12.2.3 through 12.2.15 — in other words, the entire currently supported EBS 12.2 line. If you run EBS, the short version is: patch now, and don't wait for a confirmed breach to treat this as urgent.

What happened with Oracle E-Business Suite this month

Oracle's October 2026 Critical Patch Update — its quarterly, coordinated security release — contains 194 new security patches for E-Business Suite alone, 31 of which Oracle itself flags as remotely exploitable without authentication. Buried in that risk matrix are two standout entries: CVE-2026-101767, an unauthenticated SQL injection in the Application Object Library that can be chained into remote code execution, and CVE-2026-101809, a Workflow Notification Mailer flaw that Oracle rates 10.0 — the highest score the CVSS 3.1 scale allows. Oracle publishes these risk matrices directly on its security-alerts site, and this one explicitly lists Protocol: HTTP and Remote Exploit without Authentication: Yes for both entries, meaning an attacker needs nothing more than network access to a vulnerable EBS web tier to attempt an attack.

The flaw was reported to Oracle by Horizon3.ai's attack research team — specifically Brandon Peterson, Jimi Sebree, and Noah King — who disclosed it to Oracle on July 24, 2026, roughly three months before the fix shipped. That is a fairly standard coordinated-disclosure runway for an enterprise vendor, but it also means the technical details of the flaw have now been public, in some detail, since Horizon3.ai published its own research write-up around the time of the October 20 patch release.

The two critical EBS flaws, side by side

Both vulnerabilities live in core EBS infrastructure rather than an optional module, which is part of why they matter: Application Object Library and Workflow Notification Mailer are present in effectively every EBS deployment. Here is how Oracle's own risk matrix scores them.

The difference between 9.8 and a perfect 10.0 comes down to one letter in the vector string: CVE-2026-101809's scope is rated "Changed" (S:C) rather than "Unchanged" (S:U), meaning a successful exploit can affect resources beyond the vulnerable component itself. In practice, both are about as severe as the CVSS scale gets — network-reachable, no authentication, no user interaction, and high impact to confidentiality, integrity, and availability all at once. For a primer on how base scores and vectors like these are actually calculated, see our explainer on CVE identifiers and CVSS scoring.

How the Application Object Library flaw works

According to Horizon3.ai's own technical write-up, CVE-2026-101767 is an unauthenticated SQL injection vulnerability in the EBS Thin Client Framework (TCF) servlet, reachable at the path /OA_HTML/AppsTCFServer and implemented server-side by the class oracle.apps.fnd.tcf.SocketServer. Horizon3.ai maps the bug to two underlying weakness classes: CWE-89 (SQL Injection) and CWE-306 (Missing Authentication for Critical Function) — the servlet simply doesn't require a login before accepting input that ends up in a database query. From there, Horizon3.ai describes a path to chain the injection into full remote code execution, which is what justifies the 9.8 score: this isn't a blind-SQLi-for-data-exfiltration bug, it's a foothold that can escalate to running arbitrary commands on the EBS server.

Oracle has not published its own technical breakdown of the exploit chain beyond the risk-matrix entry, which is standard practice — vendors generally don't detail attack mechanics in their advisories, leaving that to the researchers who found the bug. Horizon3.ai's write-up is the most detailed public technical source at this point.

Is Oracle EBS being actively exploited right now?

This is the part worth being precise about. Horizon3.ai's own research post does not claim to have observed live, in-the-wild exploitation of CVE-2026-101767 — what it does include is detection guidance: specifically, indicators of compromise such as unauthenticated POST requests to the TCF servlet followed shortly afterward by SQL-reconnaissance-style traffic. That is guidance for defenders to watch for probing, not a confirmed report of breaches tied to this specific CVE. As of this writing, neither CVE-2026-101767 nor CVE-2026-101809 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, which is the clearest official signal of confirmed active exploitation.

That said, the pattern is familiar enough that treating it as "not yet widely exploited" rather than "safe" is the right read. Once a researcher publishes a detailed technical write-up — including the vulnerable path and the servlet class involved — internet-wide scanning for that exact signature tends to follow within days, not weeks. Security teams should assume reconnaissance against the TCF servlet is plausible now that the details are public, even without a confirmed breach report to point to yet.

Who found it, and why that matters

Oracle's October 2026 CPU credit statement names three Horizon3.ai researchers — Brandon Peterson, Jimi Sebree, and Noah King — as the reporters of CVE-2026-101767. Horizon3.ai is an offensive-security research firm that regularly publishes attack-path research on enterprise software and runs a "Rapid Response" service that notifies its own customers when a flaw it discovers is disclosed. That commercial incentive is worth noting for context, but it doesn't change the underlying facts Oracle itself confirmed in its advisory: the component, the score, and the affected version range all come directly from Oracle's own risk matrix, not from Horizon3.ai's marketing.

Oracle's credit statement for the October 2026 CPU does not list an individual or organization credit specifically tied to CVE-2026-101809 in the same entry, so we aren't attributing that discovery to a named researcher here.

Why this lands differently after the 2025 Clop campaign

Oracle E-Business Suite has been through this before, and recently. In 2025, a separate unauthenticated remote-code-execution flaw in EBS's BI Publisher Integration component, CVE-2025-61882, was exploited as a zero-day by an extortion operation using the Cl0p brand. According to a joint Google Threat Intelligence Group and Mandiant analysis, suspicious activity consistent with exploitation dates back to July 2025, with data theft from EBS environments observed from around August 9, 2025 — weeks before Oracle shipped an emergency patch on October 4, 2025. Extortion emails sent from large numbers of compromised third-party accounts reached company executives starting in late September 2025, and GTIG noted that a significant amount of data was exfiltrated from affected organizations, though it stopped short of formally attributing the campaign to a specific tracked threat actor.

That history is the backdrop against which this new flaw lands: EBS is a known, high-value target for data-theft extortion, it sits on networks that typically hold financial, HR, and supply-chain data, and attackers have already demonstrated they will weaponize EBS pre-auth RCE bugs quickly once details become available. Nothing currently confirms this October 2026 flaw is being used by the same actors as the 2025 campaign — there is no public evidence tying CVE-2026-101767 or CVE-2026-101809 to Cl0p or any other named group — but the precedent is exactly why security teams are treating "patch now" as a more urgent instruction than usual for an EBS CPU. It's a similar dynamic to what we've seen with other enterprise web platforms sitting on sensitive data; the critical pre-auth upload flaw CISA flagged in Adobe Commerce followed a comparable pattern of disclosure-then-scanning.

Which EBS versions are affected

Oracle's risk matrix lists the same affected range for both CVEs: Oracle E-Business Suite 12.2.3 through 12.2.15. That spans every version currently under Oracle's Premier or Extended Support for the 12.2 line — there is no untouched "safe" minor version within 12.2.3–12.2.15. Oracle's advisory also notes that EBS deployments include underlying Oracle Database and Oracle Fusion Middleware components, and that database- or middleware-level vulnerabilities patched elsewhere in the same October 2026 CPU can separately affect EBS exposure; those are tracked in Oracle's Database and Fusion Middleware risk matrices rather than the EBS one, so a full remediation pass needs to check those sections too, not just the EBS-specific CVEs.

If you're running an EBS release earlier than 12.2.3, Oracle's standard guidance applies: unsupported releases aren't tested against new CPU vulnerabilities, but it's reasonable to assume older branches share the same underlying code paths and should be prioritized for an upgrade rather than assumed safe by omission.

How to patch Oracle E-Business Suite now

The October 2026 Critical Patch Update is available through Oracle's standard patch-delivery channels for EBS customers with active support. Oracle's own October 2026 EBS risk-matrix page points administrators to My Oracle Support's EBS Release 12 Critical Patch Update Knowledge Document for the specific patch numbers that apply to a given EBS configuration, since the exact patch set depends on which database and middleware versions underpin a given instance. The practical sequence for most teams:

• Pull the October 2026 CPU patch list for your specific EBS 12.2.x release from My Oracle Support, cross-referencing the EBS Knowledge Document rather than assuming one patch number covers every configuration.
• Patch a non-production/staging EBS instance first and validate core workflows — Workflow Notification Mailer and Application Object Library changes can touch functionality broadly used across modules.
• Roll the patch to internet-facing production instances first, then internal-only instances, given that CVE-2026-101767 and CVE-2026-101809 are both remotely reachable over HTTP.
• Re-check Oracle Database and Fusion Middleware patch levels underneath EBS in the same CPU cycle, since those aren't bundled into the EBS-specific patches.

Mitigations if you can't patch immediately

Patching is the only complete fix, but Oracle's own advisory language — echoed by Horizon3.ai's guidance — points to reducing exposure in the interim: restrict network access to the EBS web tier to known, trusted IP ranges rather than leaving it open to the general internet, and specifically consider blocking or tightly controlling access to the /OA_HTML/AppsTCFServer path at a web application firewall or reverse proxy until the patch is applied. This is the same "reduce the attack surface while you queue the real fix" approach that applies to most pre-auth RCE disclosures in enterprise platforms — it buys time, but as Oracle itself notes in its CPU guidance, blocking network protocols is not a substitute for patching and can break legitimate functionality if applied too broadly. Monitoring web-tier access logs for the unauthenticated-POST-then-SQL-recon pattern Horizon3.ai describes is a reasonable interim detection step while patches roll out. The urgency here mirrors what we've written about other unauthenticated, internet-reachable RCE classes before: once exploit details are public, the window between disclosure and opportunistic scanning for unpatched servers tends to be short.

Frequently asked questions

What to do next

If your organization runs Oracle E-Business Suite 12.2.3 through 12.2.15, the October 2026 Critical Patch Update is not an optional, next-quarter item — it closes two flaws that require no credentials, no user interaction, and no special network position beyond basic HTTP reachability. Pull the specific patch numbers for your configuration from My Oracle Support's EBS Knowledge Document, patch internet-facing instances first, and validate in staging before rolling to production given how central the Application Object Library and Workflow Notification Mailer components are to day-to-day EBS operation. If a full patch cycle will take more than a few days, restrict external access to the EBS web tier in the meantime and watch logs for the detection pattern Horizon3.ai has published. And because EBS has already been the target of one large-scale extortion campaign in the past year, this is a good moment to confirm your incident-response plan actually covers an EBS compromise scenario specifically, rather than assuming general ransomware playbooks will transfer cleanly.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage