Unauthenticated SQL injection in Oracle E-Business Suite Application Object Library
Oracle EBS Application Object Library contains an unauthenticated SQL injection flaw allowing remote code execution. CVSS 9.8; patched in Oracle's October 2026 CPU; active probing confirmed.
- Vendor
- Oracle
- Product
- E-Business Suite (Application Object Library)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
Is CVE-2026-101767 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-101767 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-28 snapshot.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-28. Full cross-catalog view: /kev-comparison
CVE-2026-101767 timeline
- Published to NVD
- Exploitation reported+7dDefused Cyber honeypots logged exploratory exploitation attempts
- First 0dayNews coverage+8d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
An unauthenticated attacker can send a crafted HTTP request to the Oracle E-Business Suite Application Object Library component and trigger SQL injection, potentially achieving remote code execution. No authentication is required; the attack surface is the HTTP interface.
Oracle patched CVE-2026-101767 in its October 2026 Critical Patch Update. Horizon3.ai discovered and reported the flaw. Threat intelligence firm Defused Cyber reported the first exploitation attempts on October 27, 2026, one day after patch availability.
Patch: Apply Oracle’s October 2026 CPU. No workaround is a substitute for the patch at this severity level.
Other Oracle CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-114820 Oracle Java SE JSSE unauthenticated TLS compromisewrite-up | [ CRITICAL ] | 9.1 | 0.3% | — |
| CVE-2026-21962 Oracle WebLogic/HTTP Server unauthenticated data access via HTTPwrite-up | [ CRITICAL ] | 10.0 | 73.2% | |
| CVE-2026-46817 Oracle E-Business Suite Payments improper privilege management (unauth RCE)write-up | [ CRITICAL ] | 9.8 | 12.3% | |
| CVE-2026-35273 Oracle PeopleSoft PeopleTools missing authentication allows unauthenticated takeoverransomware usewrite-up | [ CRITICAL ] | 9.8 | 96.7% | |
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | [ HIGH ] | 7.5 | 74.2% | |
| CVE-2025-61757 Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | [ CRITICAL ] | 9.8 | 88.6% | |
| CVE-2025-61884 Oracle E-Business Suite Server-Side Request Forgery (SSRF) Vulnerabilityransomware use | [ HIGH ] | 7.5 | 95.9% | |
| CVE-2025-61882 Oracle E-Business Suite BI Publisher Integration unauth RCEransomware usewrite-up | [ CRITICAL ] | 9.8 | 99.7% |
