{"slug":"oracle-ebs-cve-2026-101767","title":"Oracle EBS pre-auth RCE chain (per Horizon3) (CVE-2026-101767)","shortName":"Oracle EBS","summary":"Unauthenticated SQL injection in the Oracle E-Business Suite Thin Client Framework servlet at /OA_HTML/AppsTCFServer that Horizon3 says chains to OS command execution as the EBS application account. Oracle October 2026 CPU (20 Oct 2026) patches Application Object Library 12.2.3 through 12.2.15. Defused reported exploratory exploits against decoys on 27 Oct 2026 (attempts only). Oracle: no statement yet on in-the-wild use. Not in CISA KEV (catalog 2026.10.28, checked 29 Oct 2026).","isExample":false,"draft":false,"family":"oracle-ebs-cve-2026-101767","kind":"single-product","aliases":["CVE-2026-101767","Oracle E-Business Suite TCF SQLi","AppsTCFServer"],"publishedAt":"2026-10-29","updatedAt":"2026-10-29","patchStatus":"patched","exploited":"attempts","scores":{"cve":"CVE-2026-101767","cvss":{"cve":"CVE-2026-101767","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","sourceDate":"2026-10-20","checkedDate":"2026-10-29"},"epss":{"cve":"CVE-2026-101767","score":0.00614,"percentile":0.49263,"date":"2026-10-28","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-101767","checkedDate":"2026-10-29"},"kev":{"cve":"CVE-2026-101767","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.28","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-29"},"addedDate":"2026-10-29"},"priority":{"label":"high"},"managementSummary":{"what":"Unauthenticated SQL injection in Oracle E-Business Suite TCF (CVE-2026-101767, CVSS 9.8) that Horizon3 says chains to OS command execution as the EBS application account. Defused reported exploratory exploits against decoys on 27 Oct 2026 (attempts only). Oracle: no statement yet. Not in CISA KEV (checked 29 Oct 2026).","action":"Apply the Oracle October 2026 Critical Patch Update to E-Business Suite Application Object Library 12.2.3 through 12.2.15. Until then, remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict the web tier to trusted networks. Hunt POSTs to that path and Horizon3's host and database IOCs."},"seenInTheWild":[{"metric":"third-party-stated","value":"Exploratory exploits against CVE-2026-101767 on Oracle E-Business Suite decoys on 27 Oct 2026","observer":"Defused","date":"2026-10-27","method":"Honeypot / decoy. Quoted by BleepingComputer and SecurityWeek. Attempts only. Not an Oracle statement.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/"},{"metric":"exposed","value":"over 670","observer":"Shadowserver (via BleepingComputer)","date":"2026-10-28","method":"BleepingComputer: Shadowserver tracks over 670 internet-exposed Oracle EBS instances, most with US addresses. Not a vulnerable count. Does not say how many are honeypots or already patched.","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-29","items":[{"text":"Defused said its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on 27 Oct 2026. Third-party honeypot report; not a compromise claim. Oracle: no statement yet. Not in CISA KEV (catalog 2026.10.28, checked 29 Oct 2026).","headline":"Defused recorded exploratory exploits on 27 Oct 2026 (not a compromise claim)","section":"exploitation","date":"2026-10-29","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","alsoSourceUrl":"https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-29","kind":"page"}]},"whatTheBugIs":"CVE-2026-101767 is a vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Oracle's October 2026 Critical Patch Update (risk matrix row, opened 29 Oct 2026) says an easily exploitable issue allows an unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library, with CVSS 3.1 base score 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Supported versions named in that row are 12.2.3 through 12.2.15. Oracle credits Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai. The 9.8 score and vector are from Oracle's October 2026 CPU (20 Oct 2026). The NVD record (published 20 Oct 2026 22:18 UTC, lastModified 21 Oct 2026, checked 29 Oct 2026) is still Awaiting Analysis and lists Oracle's 9.8 metric as a Secondary source; 21 Oct is NVD's lastModified date, not the scoring date. NVD also republishes a CISA Coordinator SSVC option exploitation: none dated 21 Oct 2026; that is not a KEV listing and predates the 27 Oct decoy report.\n\nHorizon3 (20 Oct 2026) describes the issue as unauthenticated SQL injection in the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer, implemented by oracle.apps.fnd.tcf.SocketServer. Horizon3 says that path is permitted through the default EBS URL firewall, that SQL runs as the APPS database user, and that the chain can run operating system commands as the EBS application account. Horizon3 rates it CVSS 3.1 9.8 with the same vector as Oracle. Horizon3 says it reported the issue to Oracle on 24 Jul 2026. This page does not republish request bodies or exploit steps.\n\nOracle's public CVE row does not use the words SQL injection or remote code execution. Horizon3 and later coverage do. Those wordings are shown dated and are not resolved here.\n\nExploitation status: Defused reported exploratory exploits against EBS decoys on 27 Oct 2026 (attempts only). Oracle: no statement yet on in-the-wild use (The Register reported on 28 Oct 2026 that Oracle did not immediately respond). Not in CISA KEV (catalog 2026.10.28, released 2026-10-28T19:00:04Z, 1,762 entries, checked 29 Oct 2026).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"internet","label":"Internet to EBS web tier","detail":"Network access to an affected E-Business Suite web tier over HTTP or HTTPS."},{"id":"app","label":"/OA_HTML/AppsTCFServer","detail":"Unauthenticated request reaches the TCF servlet (oracle.apps.fnd.tcf.SocketServer). Horizon3: on the default URL firewall allowlist."},{"id":"exploit","label":"SQL as APPS","detail":"Horizon3: SQL runs as the APPS database user. Conceptual impact class only."},{"id":"exec","label":"OS command as EBS account","detail":"Horizon3: the chain can run operating system commands as the EBS application account."},{"id":"shell","label":"Financial / HR data and host","detail":"Horizon3: data reachable by APPS may include financial, payroll, HR, and procurement records. Host access follows the EBS account's permissions."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-28","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 29 Oct 2026) against catalog 2026.10.28 (released 2026-10-28T19:00:04Z, 1,762 entries). CVE-2026-101767 is not listed. The NVD record includes a CISA Coordinator SSVC option exploitation: none dated 21 Oct 2026; that is not a KEV listing."},"firstSeen":{"date":"2026-10-27","source":"Defused (quoted by BleepingComputer and SecurityWeek)","note":"Defused said its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on 27 Oct 2026. Third-party honeypot report. Attempts only. Oracle: no statement yet (The Register reported on 28 Oct 2026 that it reached out to Oracle, including whether Oracle had documented successful exploitation, and did not receive an immediate response). Not in CISA KEV (checked 29 Oct 2026). First calendar day of successful compromise: not verified."},"vendorStatements":[{"vendor":"Oracle","date":"2026-10-20","statement":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","retracted":false}]},"timeline":[{"date":"2026-07-24","event":"Horizon3 says it disclosed the issue to Oracle on 24 Jul 2026.","source":{"title":"Oracle E-Business Suite TCF SQL Injection and Remote Code Execution","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","publisher":"Horizon3.ai"},"kind":"disclosure","addedDate":"2026-10-29"},{"date":"2026-10-20","event":"Oracle published the October 2026 Critical Patch Update. CVE-2026-101767: Application Object Library Core, HTTP, unauthenticated, CVSS 9.8, supported versions 12.2.3-12.2.15. Credits: Brandon Peterson, Jimi Sebree, and Noah King of Horizon3.ai. Patch details: My Oracle Support Note KA923 (login).","source":{"title":"Oracle Critical Patch Update Advisory - October 2026","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","publisher":"Oracle"},"kind":"patch","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-20","event":"Horizon3 published a defender-facing advisory: unauthenticated SQL injection in /OA_HTML/AppsTCFServer that chains to OS command execution as the EBS application account. Workarounds and IOCs included. This site does not republish exploit details.","source":{"title":"CVE-2026-101767: Oracle EBS SQL Injection RCE","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","publisher":"Horizon3.ai"},"kind":"advisory","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-20T22:18:32.060Z","event":"NVD published CVE-2026-101767 at 22:18 UTC. Status when we opened the record on 29 Oct 2026: Awaiting Analysis. CNA Oracle metric on that record is CVSS 3.1 9.8.","source":{"title":"NVD - CVE-2026-101767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-29"},{"date":"2026-10-21T18:44:55.490Z","event":"NVD last modified CVE-2026-101767 (18:44 UTC). The record republishes the Oracle CNA 9.8 metric and a CISA Coordinator SSVC option exploitation: none.","source":{"title":"NVD - CVE-2026-101767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","publisher":"NVD"},"kind":"disclosure","addedDate":"2026-10-29"},{"id":"exploitation-attempts","date":"2026-10-27","event":"Defused said its Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 on 27 Oct 2026. Third-party honeypot report. Attempts only.","source":{"title":"Hackers now scanning systems for recently-patched Oracle flaw","url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","publisher":"BleepingComputer"},"kind":"other","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-28","event":"SecurityWeek, BleepingComputer, The Hacker News, The Register, and Orca published coverage of the Defused decoy report. BleepingComputer: Shadowserver tracks over 670 internet-exposed Oracle EBS instances (not a vulnerable count). The Register: Oracle did not immediately respond on whether it had documented successful exploitation.","source":{"title":"Hackers Start Probing Fresh Oracle EBS Vulnerability","url":"https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/","publisher":"SecurityWeek"},"kind":"advisory","addedDate":"2026-10-29"}],"openNotes":[{"title":"Oracle CPU row versus Horizon3 SQL injection wording","detail":"Oracle's October 2026 risk-matrix row for CVE-2026-101767 describes unauthenticated HTTP takeover of Application Object Library at CVSS 9.8. It does not say SQL injection or OS command execution. Horizon3 (20 Oct 2026) describes unauthenticated SQL injection in /OA_HTML/AppsTCFServer that chains to OS commands as the EBS application account. This page stores both wordings dated. They are not resolved here.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"},{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"In-the-wild status is attempts only","detail":"Defused reported exploratory exploits against EBS decoys on 27 Oct 2026. That is a third-party honeypot report of attempts. Oracle: no statement yet (The Register reported on 28 Oct 2026 that Oracle did not immediately respond). Not in CISA KEV (checked 29 Oct 2026). Independent validation of successful compromise: not verified.","sources":[{"url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","date":"2026-10-28","publisher":"BleepingComputer"},{"url":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","date":"2026-10-28","publisher":"The Register"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-28","publisher":"CISA"}]},{"title":"Earlier unsupported EBS versions","detail":"Oracle's October 2026 CPU generic note says product releases that are not under Premier Support or Extended Support are not tested for these issues, and that earlier versions of affected releases are likely also affected. That sentence is CPU-wide, not a CVE-2026-101767-specific version table. This page follows the named 12.2.3-12.2.15 row for the version table.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"}]}],"defenderActions":[{"title":"Inventory EBS 12.2.3 through 12.2.15 and web-tier reachability","detail":"Find every Oracle E-Business Suite instance on Application Object Library 12.2.3 through 12.2.15, including staging. Record whether untrusted networks can reach the web tier. Oracle also recommends applying the October 2026 CPU to the Database and Fusion Middleware components used by EBS.","priority":"now","links":[{"label":"Oracle October 2026 CPU","href":"https://www.oracle.com/security-alerts/cpuoct2026.html"}]},{"title":"Apply the October 2026 CPU, or restrict the TCF servlet until you can","detail":"Oracle: apply the October 2026 Critical Patch Update. Patch list: My Oracle Support Note KA923 (login). Horizon3 until then: remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist, and restrict the EBS web tier to trusted networks.","priority":"now","links":[{"label":"Horizon3 advisory","href":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/"},{"label":"Oracle October 2026 CPU","href":"https://www.oracle.com/security-alerts/cpuoct2026.html"}]},{"title":"Hunt Horizon3 IOCs if the servlet was reachable","detail":"Horizon3 (20 Oct 2026): unauthenticated POSTs to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer followed by database activity; SQL reconnaissance shortly after unauthenticated web requests; unexpected files in $APPLPTMP; the oracle account spawning /bin/sh via the Concurrent Manager. Researcher-reported IOCs, not in-the-wild observations. Independent validation: not verified.","priority":"now","links":[{"label":"Horizon3 advisory","href":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/"}]}],"detection":[{"title":"POST /OA_HTML/AppsTCFServer on the EBS web tier","detail":"Horizon3: unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity. Review Oracle HTTP Server, web-tier, and WAF access logs for POST to that path. Presence of a POST is reachability plus a request, not proof of compromise. This site does not republish request bodies.","logSource":"EBS web tier / Oracle HTTP Server access logs, or WAF logs, for POST /OA_HTML/AppsTCFServer","kind":"generic","group":"web-proxy","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20"},{"title":"SQL reconnaissance by APPS shortly after unauthenticated web requests","detail":"Horizon3: SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects). Review database audit for APPS sessions that follow unauthenticated hits on /OA_HTML/AppsTCFServer. No published query text from Oracle. Independent validation: not verified.","logSource":"Oracle Database audit for the APPS user","kind":"generic","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20"},{"title":"oracle account spawning /bin/sh via Concurrent Manager","detail":"Horizon3: unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager to run OS commands. Review EDR or process audit on the EBS application host. Researcher-reported, not an in-the-wild observation.","logSource":"EDR / process audit on the EBS application host","kind":"generic","group":"edr","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20"},{"title":"File integrity on $APPLPTMP","detail":"Horizon3 names unexpected files in $APPLPTMP as an indicator. Review create and modify timestamps in that directory after 20 Oct 2026. Researcher-reported, not an in-the-wild observation. No published filenames from a source we opened beyond that directory variable.","logSource":"Filesystem metadata on $APPLPTMP","kind":"generic","group":"edr","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20"}],"detectionRules":[{"id":"v2s-sigma-oracle-ebs-tcf-post","title":"Oracle EBS TCF servlet POST","language":"sigma","query":"title: Oracle EBS TCF servlet POST (CVE-2026-101767 hunt)\nid: 7c2e1a04-9b5d-4f31-a8c6-2d0e6b91f4aa\nstatus: experimental\ndescription: Detects HTTP POST requests to the E-Business Suite Thin Client Framework servlet path named by Horizon3 for CVE-2026-101767. Path hunt only. Not a payload detector.\nreferences:\n    - https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-101767\nauthor: vuln2shell\ndate: 2026-10-29\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: POST\n        cs-uri-stem|contains: '/OA_HTML/AppsTCFServer'\n    condition: selection\nfalsepositives:\n    - Legitimate EBS clients that still call the TCF servlet\nlevel: high","logSource":"EBS web tier / Oracle HTTP Server access logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting query from the servlet path Horizon3 named. A POST is not proof of compromise. Tune field names to your shipper.","tested":"untested"},{"id":"v2s-spl-oracle-ebs-tcf-post","title":"Oracle EBS TCF servlet POST (SPL)","language":"spl","query":"index=* (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=aws:waf:logs)\n(\"/OA_HTML/AppsTCFServer\") method=POST\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"EBS web tier / Oracle HTTP Server access logs, or WAF logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Tune sourcetype and field names to your shipper. Optional follow-on: search the same window for the string oracle.apps.jtf.gantt.server.GanttDataServer if your logs store request bodies.","tested":"untested"},{"id":"v2s-kql-oracle-ebs-tcf-post","title":"Oracle EBS TCF servlet POST (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csMethod == \"POST\"\n| where csUriStem has \"/OA_HTML/AppsTCFServer\"\n| summarize count() , min(TimeGenerated), max(TimeGenerated) by Computer, cIP, scStatus\n| order by count_ desc","logSource":"EBS web tier access logs shipped to Microsoft Sentinel / Defender","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Table and field names vary by parser. Map W3CIISLog to your OHS or reverse-proxy ingestion.","tested":"untested"},{"id":"v2s-esql-oracle-ebs-tcf-post","title":"Oracle EBS TCF servlet POST (ES|QL)","language":"esql","query":"FROM logs-*\n| WHERE http.request.method == \"POST\" AND url.path LIKE \"*OA_HTML/AppsTCFServer*\"\n| STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp) BY host.name, source.ip, http.response.status_code","logSource":"EBS web tier access logs shipped to Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Path hunt only. Index and field names vary by ingest pipeline.","tested":"untested"}],"detectionLinks":[{"title":"Horizon3 CVE-2026-101767 advisory (IOCs)","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","author":"Horizon3.ai","date":"2026-10-20","note":"Public analysis and IOCs for defenders. This site does not republish exploit code."}],"retrohunt":{"summary":"If an EBS web tier on 12.2.3 through 12.2.15 was reachable, hunt from 20 Oct 2026 in web-tier and WAF logs for POST /OA_HTML/AppsTCFServer, then in database audit for APPS reconnaissance and on the host for $APPLPTMP file creates and the oracle account spawning /bin/sh.","lookback":{"from":"2026-10-20","basis":"public-disclosure","rationale":"Oracle published the October 2026 CPU and Horizon3 published the public advisory and IOCs on 20 Oct 2026. Defused reported decoy attempts on 27 Oct 2026. No sourced first-compromise calendar day exists. Hunt from the public disclosure.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"},{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","date":"2026-10-28","publisher":"BleepingComputer"}]},"logSources":[{"name":"EBS web tier / Oracle HTTP Server access logs and WAF logs","why":"Horizon3 names unauthenticated POSTs to /OA_HTML/AppsTCFServer as the access path.","required":true},{"name":"Oracle Database audit for the APPS user","why":"Horizon3 names SQL reconnaissance (database version, current user, directory objects) shortly after unauthenticated web requests.","required":true},{"name":"EDR / process audit on the EBS application host","why":"Horizon3 names the oracle account spawning /bin/sh via the Concurrent Manager.","required":true},{"name":"Filesystem metadata on $APPLPTMP","why":"Horizon3 names unexpected files in $APPLPTMP.","required":false}],"steps":[{"title":"List POST /OA_HTML/AppsTCFServer since 20 Oct 2026","detail":"Search OHS, reverse-proxy, or WAF logs for POST to /OA_HTML/AppsTCFServer. Optional: if logs store request bodies, search the same window for oracle.apps.jtf.gantt.server.GanttDataServer. A POST is not proof of compromise. Do not send crafted requests.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"Review APPS database audit after those requests","detail":"Horizon3: SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects). Correlate APPS sessions to the web-tier timestamps.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"Review $APPLPTMP timestamps and oracle spawning /bin/sh","detail":"Horizon3: unexpected files in $APPLPTMP and the oracle account spawning /bin/sh via the Concurrent Manager. Researcher-reported IOCs, not in-the-wild observations.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]}],"queries":[{"id":"v2s-spl-oracle-ebs-tcf-retrohunt","title":"Oracle EBS TCF servlet POST since 20 Oct 2026","language":"spl","query":"index=* (\"/OA_HTML/AppsTCFServer\") method=POST earliest=10/20/2026:00:00:00\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by host, uri_path, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"EBS web tier / Oracle HTTP Server access logs, or WAF logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Lookback window from public disclosure. Tune sourcetype to your shipper.","tested":"untested","timeRange":"From 20 Oct 2026 (Oracle CPU and Horizon3 advisory) through the last patch window"}],"artefacts":[{"kind":"web-log","value":"POST /OA_HTML/AppsTCFServer","detail":"Horizon3 access path. A POST is reachability plus a request, not proof of compromise.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"kind":"web-log","value":"oracle.apps.jtf.gantt.server.GanttDataServer","detail":"Horizon3: POSTs that instantiate this Gantt data-server class, followed by backend database activity. Researcher-reported.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"kind":"file","value":"$APPLPTMP","detail":"Horizon3: unexpected files in this directory. Researcher-reported, not an in-the-wild observation. No published filenames beyond the directory variable.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"kind":"process","value":"oracle account spawning /bin/sh via Concurrent Manager","detail":"Horizon3 indicator for OS command execution as the EBS application account. Researcher-reported.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"kind":"account","value":"APPS","detail":"Horizon3: SQL runs as the APPS database user. Hunt reconnaissance (database version, current user, directory objects) after unauthenticated web requests.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"}],"iocNote":"No published attacker IPs, hashes, or user-agents from a source we opened as of 29 Oct 2026. Horizon3 IOCs are path, class-name, directory, and process indicators. Do not invent IPs or hashes.","hitMeaning":[{"level":"attempt","detail":"POST /OA_HTML/AppsTCFServer from an untrusted network, with no matching APPS reconnaissance and no unexpected $APPLPTMP or /bin/sh activity."},{"level":"likely-compromise","detail":"Those POSTs plus APPS SQL reconnaissance shortly afterward, or unexpected files in $APPLPTMP, or the oracle account spawning /bin/sh via the Concurrent Manager, after 20 Oct 2026 on a 12.2.3-12.2.15 host that was reachable."},{"level":"compromise","detail":"Evidence that attacker-controlled SQL or OS commands ran on the EBS instance. No sourced in-the-wild procedure was published in the sources we opened. Independent validation: not verified.","label":"Compromise (your evidence)"}],"nextSteps":[{"title":"Remove the TCF servlet from the URL firewall allowlist and apply the October 2026 CPU","detail":"Horizon3: remove /OA_HTML/AppsTCFServer from the allowlist and restrict the web tier. Oracle: apply the October 2026 CPU (MOS Note KA923).","links":[{"label":"Horizon3 advisory","href":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/"},{"label":"Oracle October 2026 CPU","href":"https://www.oracle.com/security-alerts/cpuoct2026.html"}]},{"title":"Preserve $APPLPTMP and process-audit evidence before patching overwrites it","detail":"Keep copies and timestamps of unexpected $APPLPTMP files, plus web-tier and database-audit logs from 20 Oct 2026 onward, before restore or upgrade.","links":[{"label":"Horizon3 advisory","href":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/"}]}],"limits":["Horizon3 IOCs are researcher-reported, not observed in-the-wild persistence.","No published attacker IPs. A POST to /OA_HTML/AppsTCFServer is not proof of compromise.","Oracle's public CVE row does not name the servlet path; that path comes from Horizon3.","First calendar day of successful compromise: not verified."],"sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"},{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"}],"updatedAt":"2026-10-29"},"amIAffected":{"summary":"Oracle names Application Object Library 12.2.3 through 12.2.15 as the supported affected range. The fix is the October 2026 Critical Patch Update (MOS Note KA923, login). Earlier unsupported releases are likely affected per Oracle's generic CPU note; that is not a CVE-specific table row. No public CLI version string was copied from the CPU in this pass.","checks":[{"id":"v2s-aia-oracle-ebs-cve-2026-101767-version-1","kind":"version","title":"Record the E-Business Suite Applications version against the October 2026 CPU row","detail":"Oracle risk matrix: Application Object Library, supported versions 12.2.3-12.2.15. No public CLI version string was copied from the CPU advisory in this pass. Use the product's own version display (Oracle Applications Manager or About this Page) and compare it to that row.","command":"Record the installed Oracle E-Business Suite Applications version from the product's own version display and compare it to the October 2026 CPU row for CVE-2026-101767 (affected 12.2.3 through 12.2.15; fix is that CPU).","affectedMeans":"The installed Applications version is 12.2.3 through 12.2.15 and the October 2026 CPU for Application Object Library is not applied.","fixedMeans":"The October 2026 CPU for Application Object Library is applied, or the instance is not on a 12.2.3-12.2.15 Applications release (then treat earlier unsupported releases as no statement yet, per Oracle's generic CPU note).","notes":"This is inventory only. My Oracle Support Note KA923 lists the patches (login). Also apply the October 2026 CPU to the Database and Fusion Middleware components used by EBS, per Oracle.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"}]},{"id":"v2s-aia-oracle-ebs-cve-2026-101767-config-2","kind":"config","title":"Record whether /OA_HTML/AppsTCFServer is on the URL firewall allowlist","detail":"Horizon3: the TCF servlet at /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) is permitted through the default EBS URL firewall. On each web tier, record whether that path is still allowlisted. Do not send crafted requests.","command":"On each EBS web tier, record whether /OA_HTML/AppsTCFServer is present on the EBS URL firewall allowlist.","affectedMeans":"The instance is on 12.2.3 through 12.2.15 without the October 2026 CPU, and /OA_HTML/AppsTCFServer remains on the allowlist.","fixedMeans":"The October 2026 CPU is applied, or /OA_HTML/AppsTCFServer has been removed from the allowlist (workaround only).","notes":"Allowlist presence is a precondition, not proof of compromise. Horizon3 workaround: remove that path until you can patch.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"id":"v2s-aia-oracle-ebs-cve-2026-101767-config-3","kind":"config","title":"Record whether the EBS web tier is reachable from untrusted networks","detail":"Horizon3: internet-facing EBS web tiers present the most direct exposure; internal deployments are also at risk if an attacker can reach the servlet. Record reachability. Do not probe the servlet.","command":"On each EBS web tier, record whether untrusted networks can complete HTTP or HTTPS connections to the Applications login or /OA_HTML/ paths.","affectedMeans":"An untrusted network can reach the EBS web tier on a 12.2.3-12.2.15 instance that is missing the October 2026 CPU.","fixedMeans":"The web tier is restricted to trusted networks, or the October 2026 CPU is applied.","notes":"Reachability is a precondition, not proof of compromise. BleepingComputer (28 Oct 2026): Shadowserver tracks over 670 internet-exposed Oracle EBS instances; that is not a vulnerable count.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","date":"2026-10-28","publisher":"BleepingComputer"}]}],"limits":["No sourced Shodan or Censys fingerprint for this CVE. Do not invent one.","No public CLI version string was copied from the October 2026 CPU.","My Oracle Support Note KA923 is behind a login; this page cites the public CPU advisory for the version row.","Earlier unsupported releases: Oracle generic CPU note only."],"sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"},{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"mitigations":{"summary":"Horizon3 documents two workarounds until the October 2026 CPU is installed: remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, and restrict the EBS web tier to trusted networks. Oracle's public CPU row names the patch, not a CVE-specific workaround.","items":[{"title":"Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist","detail":"Horizon3: remove /OA_HTML/AppsTCFServer, associated with oracle.apps.fnd.tcf.SocketServer, from the EBS URL firewall allowlist. Apply this on every unpatched 12.2.3-12.2.15 web tier.","limits":"Not a software fix. Still apply the October 2026 CPU. Horizon3 says these measures reduce exposure but do not replace patching. Apply access restrictions across all untrusted network paths to the servlet.","verify":"The EBS URL firewall allowlist no longer includes /OA_HTML/AppsTCFServer. Confirm in the firewall configuration, then re-check after the next change window. Do not send crafted requests to test the servlet.","source":{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}},{"title":"Restrict the EBS web tier to trusted networks","detail":"Horizon3: restrict access to the EBS web tier to trusted networks. Internet-facing web tiers present the most direct exposure.","limits":"Not a software fix. Internal deployments remain in scope if an attacker can reach the servlet from another segment. Still apply the October 2026 CPU.","verify":"Untrusted networks can no longer complete an HTTP or HTTPS connection to the EBS web tier. Confirm in your edge firewall or host ACL, then re-check after the next change window.","source":{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"response":{"summary":"Restrict the web tier and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist, then apply the October 2026 CPU. If the servlet was reachable on 12.2.3-12.2.15, preserve web-tier logs, APPS database audit, $APPLPTMP timestamps, and process audit for the oracle account. No sourced in-the-wild persistence list exists beyond Horizon3's researcher IOCs.","containment":[{"title":"Remove the TCF servlet from the URL firewall allowlist if you cannot patch immediately","detail":"Horizon3: remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"Restrict the EBS web tier to trusted networks","detail":"Horizon3: restrict access to the EBS web tier to trusted networks. Apply this across all untrusted paths to the servlet.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"Apply the October 2026 Critical Patch Update","detail":"Oracle: apply the October 2026 CPU to Application Object Library and to the Database and Fusion Middleware components used by EBS. Patch list: My Oracle Support Note KA923 (login). An upgrade does not replace log and timestamp review if the host was reachable while vulnerable.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"}]}],"rotate":[{"item":"Database and application credentials the APPS user and EBS application account could reach","reason":"General: if unauthenticated SQL or OS command execution succeeded, treat secrets on or behind the instance as exposed. No CVE-2026-101767-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]}],"persistence":[{"kind":"path","value":"$APPLPTMP","detail":"Horizon3: unexpected files in this directory. Researcher-reported lab indicator, not observed in-the-wild persistence. No published filenames beyond the directory variable.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"kind":"account","value":"oracle account spawning /bin/sh via Concurrent Manager","detail":"Horizon3 indicator for OS command execution as the EBS application account. Researcher-reported, not observed in-the-wild persistence.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"}],"observedBehaviour":[{"title":"Unauthenticated POST to /OA_HTML/AppsTCFServer instantiating GanttDataServer","detail":"Horizon3: unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity. Researcher-reported. This site does not republish request bodies.","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"},{"title":"SQL reconnaissance shortly after unauthenticated web requests","detail":"Horizon3: SQL reconnaissance shortly after unauthenticated web requests (database version, current user, directory objects).","sourceUrl":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","sourceDate":"2026-10-20"}],"evidence":[{"title":"Installed EBS Applications version string from before the CPU","detail":"Preserve the version you recorded against the October 2026 CPU row so you can show whether the host was 12.2.3-12.2.15 while the servlet was reachable.","sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"}]},{"title":"Web-tier and WAF logs for POST /OA_HTML/AppsTCFServer from 20 Oct 2026","detail":"Keep inbound POST records to that path. No published attacker IPs. A session is reachability, not proof of compromise.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]},{"title":"APPS database audit and $APPLPTMP timestamps","detail":"Horizon3: SQL reconnaissance after unauthenticated requests, and unexpected files in $APPLPTMP. Keep the files and their metadata from 20 Oct 2026 onward before restore or upgrade.","sources":[{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"}]}],"limits":["Horizon3 IOCs are researcher-reported, not a vendor persistence bulletin.","No published network IOCs from a source we opened.","Oracle: no statement yet on in-the-wild use. Defused 27 Oct 2026 is a decoy/attempts report. Not in CISA KEV (checked 29 Oct 2026)."],"sources":[{"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","publisher":"Oracle"},{"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","publisher":"Horizon3.ai"},{"url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","date":"2026-10-28","publisher":"BleepingComputer"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"bulletins":[{"vendor":"Oracle","title":"Oracle Critical Patch Update Advisory - October 2026 (CVE-2026-101767)","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","cve":"CVE-2026-101767"}],"coverage":[{"title":"Oracle Critical Patch Update Advisory - October 2026","publisher":"Oracle","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","date":"2026-10-20","type":"vendor","addedDate":"2026-10-29"},{"title":"Text Form of Oracle CPU October 2026 Risk Matrices","publisher":"Oracle","url":"https://www.oracle.com/security-alerts/cpuoct2026verbose.html","date":"2026-10-20","type":"vendor","addedDate":"2026-10-29"},{"title":"CVE-2026-101767: Oracle EBS SQL Injection RCE","publisher":"Horizon3.ai","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","date":"2026-10-20","type":"research","addedDate":"2026-10-29"},{"title":"NVD CVE-2026-101767","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","date":"2026-10-20","type":"government","addedDate":"2026-10-29"},{"title":"Hackers now scanning systems for recently-patched Oracle flaw","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"Hackers Start Probing Fresh Oracle EBS Vulnerability","publisher":"SecurityWeek","url":"https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch","publisher":"The Hacker News","url":"https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble","publisher":"The Register","url":"https://www.theregister.com/security/2026/10/28/oracle-celebrates-end-of-cybersecurity-awareness-month-with-quadruple-trouble/5306121","date":"2026-10-28","type":"news","addedDate":"2026-10-29"},{"title":"CVE-2026-101767: Critical Oracle EBS SQL Injection Actively Probed in the Wild","publisher":"Orca Security","url":"https://orca.security/resources/research/cve-2026-101767-critical-oracle-ebs-sql-injection-actively-probed-in-the-wild/","date":"2026-10-28","type":"research","addedDate":"2026-10-29"}],"posts":[],"research":[{"title":"Oracle Critical Patch Update Advisory - October 2026","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","authors":"Oracle (credit: Brandon Peterson, Jimi Sebree, Noah King of Horizon3.ai)","date":"20 Oct 2026"},{"title":"CVE-2026-101767: Oracle EBS SQL Injection RCE","url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","authors":"Horizon3.ai","date":"20 Oct 2026"},{"title":"NVD CVE-2026-101767 (CNA Oracle; Awaiting Analysis)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","authors":"NVD / Oracle PSIRT","date":"lastModified 21 Oct 2026, checked 29 Oct 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-101767 not listed; catalog 2026.10.28)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.28, checked 29 Oct 2026"}],"impact":{"kind":"single-product","product":"Oracle E-Business Suite Application Object Library","versions":[{"version":"Application Object Library 12.2.3 through 12.2.15","status":"affected","versions":"12.2: Oct2026CPU","vendorStatement":{"date":"2026-10-20","url":"https://www.oracle.com/security-alerts/cpuoct2026.html","quote":"CVE-2026-101767 | Oracle Application Object Library | Core | HTTP | Yes | 9.8 | 12.2.3-12.2.15"},"addedDate":"2026-10-29"},{"version":"Earlier unsupported E-Business Suite releases","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-29"}]},"pocs":[],"pocEmptyState":"No public PoC indexed. Horizon3 published technical details on 20 Oct 2026 (not indexed here as an exploit PoC). Independent public exploit PoC: not verified.","_feed":{"page":"https://vuln2shell.com/vulns/oracle-ebs-cve-2026-101767","json":"https://vuln2shell.com/vulns/oracle-ebs-cve-2026-101767.json","iocsCsv":"https://vuln2shell.com/vulns/oracle-ebs-cve-2026-101767/iocs.csv","stix":"https://vuln2shell.com/vulns/oracle-ebs-cve-2026-101767/stix.json","badges":{"patch":"Patched","itw":"Exploitation attempts","poc":"No public PoC indexed"}}}