Threat-intelligence firm Defused told BleepingComputer that its Oracle E-Business Suite decoys logged exploratory exploit attempts against CVE-2026-101767 on the morning of Oct. 27, days after Oracle issued a patch¹.

BleepingComputer, citing Oracle's October 2026 Critical Patch Update, said the company released fixes on Oct. 20 for a flaw in a core Application Object Library component and asked customers to apply security patches without delay¹. The outlet described the bug as letting unauthenticated attackers with HTTP access take over vulnerable systems in low-complexity attacks¹.

Defused characterized CVE-2026-101767 as unauthenticated SQL injection in EBS's Thin Client Framework servlet that can chain to remote code execution, according to the report¹. Oracle has not tagged the CVE as exploited in the wild, BleepingComputer said¹.

Internet watchdog Shadowserver now tracks more than 670 internet-exposed Oracle EBS instances, most with U.S. IP addresses, the report said¹. Shadowserver does not indicate how many of those hosts are honeypots or already patched against CVE-2026-101767¹.

BleepingComputer placed the scanning in a longer pattern of Oracle software abuse: Clop has exploited another EBS flaw, CVE-2025-61882, since early August 2025, and ShinyHunters used a PeopleSoft zero-day, CVE-2026-35273, between May 27 and June 9, according to that account¹. CISA has added 46 Oracle bugs to its known-exploited catalog since November 2021, 13 of them also used in ransomware, the outlet said¹.

Whether any of the Oct. 27 probes succeeded, and how many internet-facing EBS systems remain unpatched, is not established in the BleepingComputer report¹.

Sources

1. BleepingComputerHackers now scanning systems for recently-patched Oracle flaw8:19 AM

Read the original at BleepingComputer ↗