Oracle EBS SQL Injection Probed 24 Hours After Patch

Patch it now. Threat actors are already scanning for CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite’s Application Object Library component, less than 24 hours after Oracle shipped the fix in its October 2026 Critical Patch Update.

What the flaw is

The Application Object Library component in Oracle EBS accepts crafted HTTP requests from unauthenticated network attackers. A successful injection gives the attacker control over the component and a path to remote code execution on the underlying server. CVSS base score: 9.8 (critical). No authentication is required. No interaction from an authenticated user is needed.

Horizon3.ai discovered and reported the vulnerability. The October 2026 CPU is the only published fix.

Active probing confirmed

Threat intelligence firm Defused Cyber logged the first exploitation attempts against its decoys on October 27, 2026, the day after Oracle’s patch landed. The attempts were characterized as exploratory rather than targeted campaigns, but that window closes fast at CVSS 9.8 on an internet-facing ERP system.

Oracle EBS has been a consistent target this year. A CVSS 9.8 unauthenticated RCE in the Payments component (CVE-2026-46817) hit the CISA Known Exploited Vulnerabilities catalog in July. Cl0p actors exploited a separate EBS flaw for eleven months before detection in the Estée Lauder breach.

This CPU also patched a critical JSSE flaw in Oracle Java (CVE-2026-114820, CVSS 9.1) affecting all supported Java versions.

What to do

Apply Oracle’s October 2026 CPU. There is no workaround that substitutes for the patch at this severity level.

If immediate patching is not possible, restrict access to the Application Object Library component to internal networks and block unauthenticated HTTP access from the internet at the perimeter. This does not eliminate risk; it reduces the attack surface until the patch is applied.

Check your Oracle EBS version against the October 2026 CPU patch matrix, available in the official Oracle Security Alert documentation. Prioritize any internet-facing EBS instances.