Overview
- Oracle issued a fix for CVE-2026-101767 in its October 20, 2026 Critical Patch Update and urged customers to apply the update without delay.
- Researchers say the flaw is an unauthenticated SQL injection in the Thin Client Framework servlet that can be chained to remote code execution and affects EBS 12.2.3–12.2.15.
- Threat intelligence firm Defused recorded exploratory probes targeting the vulnerability on Oct. 27, and multiple groups have since observed internet-wide scans for unpatched EBS instances.
- Internet scanning groups report hundreds to thousands of exposed EBS web properties, but their data cannot confirm how many have installed the Oct. 20 patch.
- Horizon3.ai and others published indicators of compromise and short-term mitigations such as removing /OA_HTML/AppsTCFServer from allowlists and restricting web-tier access while organizations apply the patch.