Threat actors began probing a freshly patched critical flaw in Oracle E-Business Suite within days of its fix landing, according to threat intelligence firm Defused. For UK organisations still running EBS as core ERP, the window between patch release and active exploitation has already closed — vulnerability management solutions need to move faster than that.
View the data behind this chart
| Phase | Starts (week) | Duration (weeks) |
|---|---|---|
| Horizon3.ai discovery & report | 0 | 1 |
| Oracle October CPU patch released | 1 | 1 |
| Defused observes exploit probing | 2 | 1 |
What CVE-2026-101767 actually is
The vulnerability, tracked as CVE-2026-101767 with a CVSS score of 9.8, sits in the Application Object Library product within Oracle E-Business Suite. It is an SQL injection flaw that can be triggered by a remote, unauthenticated attacker over plain HTTP — no credentials, no user interaction, no prior foothold required. Oracle fixed it in last week's October Critical Patch Update, and the issue was discovered and reported by security research firm Horizon3.ai.
Successful exploitation can hand an attacker remote code execution and, per the reporting, complete takeover of the Application Object Library component. That combination — unauthenticated access plus RCE on a core EBS module — is exactly the profile that makes a patch non-optional for any organisation still running the platform in production.
Why the probing timeline matters
Defused said its Oracle EBS honeypot decoys recorded the first exploratory exploitation attempts against CVE-2026-101767 on the morning of 27 October, posting on X that the activity was observed "this morning, Oct 27." That is only days after the patch itself shipped, which tells UK security teams something important: attackers are now monitoring CPU releases and reverse-engineering patches almost as fast as vendors publish them.
There have been no further reports of successful in-the-wild compromise beyond the initial probing at the time of writing, but exploratory scanning is typically the precursor stage before weaponised attacks begin circulating more widely.
EBS has form as a ransomware target
This is not an isolated incident for Oracle's ERP suite. In June, Defused warned of attacks exploiting CVE-2026-46817, a critical flaw in the File Transmissions component of EBS's Payments product. More significantly, last year the Cl0p ransomware and extortion group exploited zero-day bugs in Oracle EBS to steal data from more than 100 organisations spanning consumer goods, energy, engineering, entertainment, finance, heavy industry, manufacturing, media, software, technology and telecommunications.
That history matters for risk assessment: EBS is not a theoretical target picked over by opportunistic scanners. It is a platform that organised extortion groups have already used at scale to breach well-resourced enterprises across almost every sector represented in the UK mid-market and FTSE supply chain.
The legacy ERP problem for UK buyers
A large share of UK organisations running EBS do so on older, customised deployments where patching is treated as a quarterly or even annual project rather than an emergency response. That approach does not survive a CVSS 9.8 unauthenticated SQL injection with an active probing campaign already under way. Teams need to confirm which EBS version and module set they hold, check it against the October CPU advisory, and apply the fix to the Application Object Library product specifically — not assume a general EBS update covers it.
Where in-house patching cycles cannot move fast enough, organisations running out-of-support or heavily customised EBS instances should look at Oracle third-party maintenance to get compensating controls and faster patch support outside Oracle's own release cadence, particularly where internal teams lack the capacity to test and deploy urgent CPU fixes on short notice.
Immediate actions and the bigger picture
Security teams should prioritise confirming exposure, applying the October CPU patch to Application Object Library, and reviewing HTTP-facing EBS endpoints for anomalous SQL-pattern traffic consistent with the Defused honeypot findings. It is also worth revisiting how CVSS scoring should shape patch triage — teams unsure how to weight a 9.8-rated unauthenticated flaw against other open tickets should understand CVE and CVSS scores before setting next week's patch order.
Given that EBS keeps recurring as an entry point for extortion operators, this is also a moment to stress-test wider detection coverage through managed detection & response, confirm a ransomware playbook is current via ransomware protection, and check that any compromised EBS account cannot move laterally thanks to zero trust segmentation. Organisations running any end-of-support components alongside EBS should also review guidance on keeping end-of-support systems secure, since unsupported adjacent systems are often the easiest pivot point once an attacker lands inside an ERP estate.
- 01SecurityWeek — Hackers Start Probing Fresh Oracle EBS Vulnerability · 27 October 2026