Attackers begin probing corporate networks for freshly patched Oracle E-Business Suite flaw

Threat intelligence firm Defused reported that attackers began scanning the internet on October 27, 2026, targeting an unpatched flaw in Oracle E-Business Suite. Tracked as CVE-2026-101767, the critical vulnerability resides in the Thin Client Framework servlet of the suite's Application Object Library. Oracle issued a fix for the bug on October 20 as part of its October 2026 Critical Security Patch Update and urged organizations to install the update without delay. [1][2]

The vulnerability involves an unauthenticated SQL injection issue that attackers can leverage through low-complexity attacks over HTTP to achieve remote code execution and seize control of affected installations. Cybersecurity monitoring group Shadowserver observed more than 670 internet-exposed Oracle E-Business Suite instances, primarily situated in the United States, although it remains unclear how many of those systems have already applied the fix or operate as honeypots. [1][2]

While Oracle has not classified the bug as exploited in the wild, enterprise suites from the company remain frequent targets for extortion groups seeking entry into corporate, government, and healthcare networks. Previous campaigns by groups like Clop and ShinyHunters targeted similar enterprise zero-days to siphon data from universities and multinational companies, contributing to 46 Oracle flaws appearing on CISA's catalog of actively exploited bugs since November 2021. [1]