Affected Systems
Oracle E-Business Suite (EBS) - all versions prior to October 2026 Critical Patch Update. Vulnerability affects the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer in the Oracle Application Object Library component. Internet-facing and internal EBS deployments are both at risk.
Exploitation Status
Active exploitation confirmed. Defused Cyber recorded exploratory exploit attempts against CVE-2026-101767 on October 27, 2026. Horizon3.ai researchers discovered and reported the flaw on July 24, 2026. Oracle patched it in their October 2026 Critical Patch Update. Attackers are actively probing for vulnerable systems.
Business Impact
Unauthenticated attackers with network access can chain SQL injection to remote code execution. Exploitation allows SQL execution as APPS database user and OS command execution as EBS application account. Attackers can read or modify financial, payroll, HR, and procurement records. Full compromise of application data and host system is possible. Oracle EBS is a high-value target - CVE-2025-61882 and CVE-2026-46817 were exploited by Cl0p ransomware in the past year.
Urgency
🔴 Immediate
Recommended Actions
- Apply Oracle's October 2026 Critical Patch Update immediately to all Oracle E-Business Suite instances
- Remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from EBS URL firewall allowlists if immediate patching is not possible
- Monitor for unauthenticated POST requests to /OA_HTML/AppsTCFServer instantiating oracle.apps.jtf.gantt.server.GanttDataServer class
- Check EBS application host for unexpected files in $APPLPTMP directory and oracle account spawning /bin/sh via Concurrent Manager
- Restrict EBS web tier access to trusted networks only and review network segmentation for internal EBS systems