What is CVE-2026-101767?

What is CVE-2026-101767?

CVE-2026-101767 is a critical remote code execution (RCE) vulnerability stemming from an unauthenticated SQL injection flaw in the Oracle Application Object Library component of Oracle E-Business Suite (EBS). Discovered and reported by Horizon3.ai’s attack research team in July 2026, this flaw allows unauthenticated remote attackers to compromise the EBS web tier and execute arbitrary system commands.

Key aspects of the vulnerability:

Attack Mechanism: An attacker sends a crafted unauthenticated HTTP/HTTPS request to the Thin Client Framework (TCF) servlet endpoint (/OA_HTML/AppsTCFServer), which is exposed through the default EBS URL firewall allowlist. By instantiating backend classes (such as the Gantt data-server class) through this interface, an attacker executes arbitrary SQL queries with the elevated privileges of the APPS database user, which can subsequently be chained via database functions or the Concurrent Manager to execute arbitrary operating system commands as the EBS application account.

Impact: Successful exploitation enables unauthenticated remote code execution (RCE) and full takeover of the Oracle Application Object Library and the underlying EBS application host, placing critical enterprise ERP data—including financial, payroll, HR, and procurement records—at risk.

Mitigation: Oracle addressed CVE-2026-101767 in its October 2026 Critical Patch Update (CPU), released on October 20, 2026. Administrators must apply the relevant security patches for their specific EBS releases using My Oracle Support Note KA923.

As temporary mitigations prior to patching, organizations should remove oracle.apps.fnd.tcf.SocketServer / /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict external network access to the EBS web tier.

How bad is this?

According to the National Vulnerability Database (NVD) and Oracle’s advisory, CVE-2026-101767 has a CVSS 3.1 Base Score of 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is categorized under CWE-89 (SQL Injection) and CWE-306 (Missing Authentication for Critical Function).

• Severity: Critical
• No privileges required: Can be triggered unauthenticated over HTTP/HTTPS
• Exploitation: Low complexity; actively probed in the wild within days of patch disclosure

Who is affected by this?

Product: Oracle E-Business Suite (Component: Oracle Application Object Library, Core)

• Oracle E-Business Suite 12.2.3
• Oracle E-Business Suite 12.2.4
• Oracle E-Business Suite 12.2.5
• Oracle E-Business Suite 12.2.6
• Oracle E-Business Suite 12.2.7
• Oracle E-Business Suite 12.2.8
• Oracle E-Business Suite 12.2.9
• Oracle E-Business Suite 12.2.10
• Oracle E-Business Suite 12.2.11
• Oracle E-Business Suite 12.2.12
• Oracle E-Business Suite 12.2.13
• Oracle E-Business Suite 12.2.14
• Oracle E-Business Suite 12.2.15

How is it exploited?

The vulnerability is remotely exploitable over HTTP or HTTPS without requiring credentials or user interaction. Threat actors target the TCF servlet (/OA_HTML/AppsTCFServer) with crafted POST requests, leverage SQL injection as the APPS database user, and spawn shell commands to establish command-and-control or execute malicious payloads on the host.

How do I protect myself?

Apply the Oracle October 2026 Critical Patch Update immediately. Consult Oracle’s advisory and My Oracle Support for the patch set matching your version of Oracle E-Business Suite.

Mitigating factors?

Deploying an inline Web Application Firewall (WAF) or IPS to block external access to /OA_HTML/AppsTCFServer prevents remote exploitation from untrusted networks. Additionally, restricting exposure of the EBS web tier entirely to private or VPN-only segments neutralizes internet-facing attack vectors.

Additional Resources:

• https://www.oracle.com/security-alerts/cpuoct2026.html
• https://nvd.nist.gov/vuln/detail/cve-2026-101767
• https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/
• https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/
• https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html