Hackers Actively Exploiting New Oracle EBS RCE Vulnerability

Hackers have begun testing a critical Oracle E-Business Suite vulnerability that can let them run commands without logging in. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026.

However, these observations do not confirm successful attacks against customer systems, and Oracle had already released a patch before the activity was detected.

Tracked as CVE-2026-101767, the flaw carries a critical CVSS score of 9.8. Horizon3.ai discovered the issue and reported it to Oracle on July 24. Oracle fixed it on October 20 through its October Critical Patch Update. Although initially reported privately as a zero-day, it was a publicly disclosed, patched vulnerability when Defused observed the probes.

Oracle EBS 0-Day Vulnerability

The weakness affects the Core component of Oracle Application Object Library in EBS versions 12.2.3 through 12.2.15. It requires network access over HTTP or HTTPS but needs neither valid credentials nor user interaction. Cyber Security News previously covered the issue in its report on Oracle’s October security update.

According to Horizon3.ai’s technical advisory, the vulnerable Thin Client Framework servlet is reachable at /OA_HTML/AppsTCFServer. A crafted request can trigger SQL injection, allowing an attacker to send database commands as the powerful APPS database user. That access can then be chained into operating system command execution under the EBS application account.

The impact extends beyond database access. Successful exploitation could expose or alter financial, payroll, human resources, and purchasing records accessible to APPS. Commands run with the application account’s permissions, rather than automatically granting full administrative control over the host.

Defused described the October 27 traffic as “exploratory exploits” against its Oracle EBS decoys. According to reports, no other public reports of exploitation had surfaced. This supports reporting active exploit attempts, but not confirmed breaches, stolen data, or a widespread campaign.

The distinction matters because Oracle EBS has faced damaging attacks before. Cyber Security News documented Cl0p exploitation of a separate Oracle EBS zero-day, CVE-2025-61882. That earlier campaign should not be confused with the newly observed TCF servlet probes.

Administrators should apply the relevant October patches promptly. Until then, Horizon3.ai recommends removing the servlet from the EBS URL firewall allowlist and restricting web access to trusted networks. The default URL firewall permits the endpoint, making configuration checks important.

Defenders should review unauthenticated POST requests invoking GanttDataServer, especially when followed by database queries. Other warning signs include unexpected files in $APPLPTMP and the oracle account launching /bin/sh through Concurrent Manager. Access restrictions reduce exposure but do not replace patching.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Hackers Actively Exploiting New Oracle EBS RCE Vulnerability appeared first on Cyber Security News.