Zero Radar
← feed
CriticalVulnerabilityCVE-2026-101767updated 28 Oct 2026, 14:01 UTC

Oracle E-Business Suite flaw lets remote attackers take over a core component

Oracle's business software has a flaw that lets someone on the internet take control of part of it without logging in. Attackers have started scanning for systems that have not yet been updated.

Attacks reported (BleepingComputer)Fix availableOfficial, 5 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?ReportedBy BleepingComputer, not officially confirmed yet
Fix available?YesPatched by Oracle in its October 2026 Critical Patch Update; the specific patched versions are not stated in the provided material. · since 28 Oct 2026
How sure is this?Official, 5 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker scansProbes internet for unpatched Oracle EBS servers
  2. 2Crafted HTTP requestUnauthenticated request carries malicious SQL
  3. 3SQL injectionFlawed input reaches the database query
  4. 4Code executionAttacker runs commands on the server
  5. ResultAttacker takes over the Oracle EBS component

What happened

A critical unauthenticated SQL injection flaw in the Core component of Oracle Application Object Library (part of Oracle E-Business Suite) can be exploited over HTTP for remote code execution.

Why it is dangerous: A successful attack can take over the affected component with high impact to confidentiality, integrity and availability, and it needs no credentials. Organizations running unpatched Oracle E-Business Suite servers exposed to the network are at risk.

Are you affected?

You are affected if you run Oracle E-Business Suite with Application Object Library in supported versions 12.2.3 through 12.2.15 and have not applied the October 2026 Critical Patch Update.

Oracle E-Business Suite, Oracle Application Object Library (Core component), supported versions 12.2.3-12.2.15

What to do

  1. Apply Oracle's October 2026 Critical Patch Update to all Oracle E-Business Suite environments immediately
  2. Check whether Oracle E-Business Suite servers are reachable from the internet and restrict access where possible
  3. Review web server and application logs for unusual SQL-like requests to Oracle EBS endpoints

Timeline

  1. 20 Oct 2026, 22:18 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:18 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 15:24 UTC
    GitHub Advisory reported on it · GitHub Advisory
  4. 28 Oct 2026, 09:19 UTC
    SecurityWeek reported on it · SecurityWeek
  5. 28 Oct 2026, 12:21 UTC
    BleepingComputer reported on it · BleepingComputer
  6. 28 Oct 2026, 12:21 UTC
    Reported by BleepingComputer
  7. 28 Oct 2026, 14:01 UTC
    The Hacker News reported on it · The Hacker News
  8. 28 Oct 2026, 14:01 UTC
    Fix: Patched by Oracle in its October 2026 Critical Patch Update; the specific patched versions are not stated in the provided material.

Sources 5 reports, oldest first

Official vendor, government CERT or advisory database

Security press established security newsrooms

Technical details

ID
CVE-2026-101767 · GHSA-mcj5-4fqr-g22c
CVSS
9.8 / 10
EPSS
0.6% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:18 UTC
On Zero Radar
before the radar started
Last change
28 Oct 2026, 14:01 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle E-Business Suite flaw lets remote attackers take over a core component · Zero Radar