# Oracle EBS: patch the flaw targeted by reported exploitation attempts Canonical: https://www.oktsec.com/radar/oracle-ebs-cve-2026-101767 Publisher: Oktsec Language: en Published: 2026-11-04T20:47:43Z Updated: 2026-11-04T20:47:43Z Record reviewed: 2026-11-04T20:47:43Z Latest evidence check: 2026-11-04T20:47:43Z Disclosed: 2026-10-20 Oracle has fixes for two Application Object Library vulnerabilities affecting EBS 12.2.3–12.2.15. Reported exploitation attempts concern CVE-2026-101767; they do not establish successful compromise or exploitation of the second CVE. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: Reported attempts target CVE-2026-101767, which requires network access but no login. Apply the applicable CPU patches promptly; attempts do not prove a successful breach. - Evidence: Attack attempts observed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: No login required - Vendor: Oracle - Products: Oracle E-Business Suite Application Object Library - CVEs: CVE-2026-101767, CVE-2026-101700 ## Technical overview CVE-2026-101767 affects the TCF servlet in Application Object Library. Horizon3 describes a path from unauthenticated SQL injection to command execution with the EBS application account’s permissions. Network reachability matters even when the application is not public. Oracle’s October CPU addresses this CVE and CVE-2026-101700. CSA lists versions 12.2.3 through 12.2.15 as affected and reports attempts against 101767. That report does not identify successful compromise of a particular organization and does not establish exploitation of 101700. Horizon3 recommends restricting the web tier and removing the affected servlet from the URL firewall allowlist until patches are installed. Use Oracle’s patch guidance for the installed configuration; access restrictions are temporary exposure reduction. For a suspected compromise, Oktsec recommends reviewing application data access and connected credentials as well as the host. Preserve evidence and distinguish a clean patch installation from a completed incident investigation. ## Recommended response Apply the applicable Oracle October 2026 CPU patches, restrict access to the affected web tier and review earlier application and database activity. Relevant to: Teams operating Oracle E-Business Suite, including finance, payroll, HR and procurement systems. ## CVE attribution - CVE-2026-101767: Oracle — Oracle E-Business Suite Application Object Library; CVSS 3.1: 9.8. [Source](https://www.oracle.com/security-alerts/cpuoct2026.html) - CVE-2026-101700: Oracle — Oracle E-Business Suite Application Object Library; CVSS 3.1: 8.1. [Source](https://www.oracle.com/security-alerts/cpuoct2026.html) ## Affected systems and fixes ### Oracle Application Object Library Affected: EBS 12.2.3 through 12.2.15, inclusive. Fixed release / action: Applicable Oracle October 2026 CPU patches; consult EBS patch availability documentation Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.03 Checked: 2026-11-03T22:13:58Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-04T12:33:51.947Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast No score returned for: CVE-2026-101767, CVE-2026-101700 EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-04T12:33:51.947Z. ## Response checklist 1. **Identify affected EBS installations** — Inventory Application Object Library versions 12.2.3–12.2.15 and all routes to the web tier. Include internal installations reachable from other systems. 2. **Apply the applicable Oracle CPU patches** — Use Oracle’s October 2026 CPU and its linked EBS patch availability documentation, including My Oracle Support Note KA923. Select patches for the installed product and prerequisites; no single replacement version is established here. 3. **Reduce access while arranging the update** — Horizon3 recommends removing /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restricting web tier access to trusted networks. Validate operational impact. These controls do not replace the patches. 4. **Review activity before patching** — Preserve web, application and database logs. Investigate unexpected requests to the TCF servlet, database activity and child processes from the EBS service account. Record gaps in telemetry; a completed patch does not rule out earlier access. ## Relevance to AI environments Oktsec recommends reviewing integrations and automation accounts that access EBS data when investigating a suspected application compromise. ## Sources - [Oracle October 2026 Critical Patch Update](https://www.oracle.com/security-alerts/cpuoct2026.html) — Oracle; Vendor notice; checked 2026-11-04T20:41:46Z - [CSA: affected versions and reported attempts](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-156/) — CSA Singapore; Government advisory; checked 2026-11-04T20:41:46Z - [Horizon3: TCF flaw, exposure reduction and investigation](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/) — Horizon3.ai; Research report; checked 2026-11-04T20:41:46Z ## Editorial record - 2026-11-04T20:47:43Z: Added product scope, source evidence and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/oracle-ebs-cve-2026-101767) · [Build a response plan](https://www.oktsec.com/radar/oracle-ebs-cve-2026-101767#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=oracle-ebs-cve-2026-101767&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=oracle-ebs-cve-2026-101767&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.