Overview
- Oracle released a fix for CVE-2026-101767 in its October 20, 2026 Critical Patch Update and has urged customers to apply the update immediately.
- Defused Cyber recorded exploratory exploit attempts on October 27, showing attackers began scanning the Internet for systems that have not yet been patched.
- The vulnerability is an unauthenticated SQL injection in the Thin Client Framework servlet that can execute SQL as the APPS database user and run operating‑system commands as the EBS application account.
- Shadowserver now tracks more than 670 internet‑exposed EBS instances and other scans show thousands of EBS web properties, which together widen the pool of at‑risk targets.
- If patching is not possible, administrators should remove /OA_HTML/AppsTCFServer from URL allowlists, restrict EBS web‑tier access to trusted networks, and monitor for IOCs such as unauthenticated POSTs to /OA_HTML/AppsTCFServer, SQL reconnaissance, unexpected files in $APPLPTMP, and spawned shells.