GoKawiilScanners probe for unpatched Oracle E-Business Suite flaw CVE-2026-101767
Security firm Defused says it detected threat actors scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that can lead to remote code execution. Oracle patched the issue in its October 20 Critical Patch Update, and Shadowserver currently tracks over 670 internet-exposed EBS instances, mostly in the US.
GoKawiil's interpretation of the reporting above, not reported fact.
The scanning activity suggests attackers are moving quickly to find unpatched systems before organizations apply Oracle's fix, a pattern that has previously led to serious breaches of Oracle EBS, including the Clop gang's exploitation of a separate flaw since August 2025. Because EBS is widely used by large enterprises and government bodies, unpatched instances could expose sensitive financial and operational data if exploitation escalates from scanning to active attacks.
- CVE-2026-101767 is a critical, unauthenticated SQL injection flaw in Oracle EBS that can enable remote code execution.
- Oracle patched the vulnerability on October 20, but Defused observed exploratory scanning against it just a week later.
- Shadowserver counts over 670 internet-exposed EBS instances, mostly in the US, though it's unclear how many remain unpatched.
Source: bleepingcomputer.com, 2026-10-28
Published there as: “Hackers now scanning systems for recently-patched Oracle flaw”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.