Hackers have initiated testing of a significant Oracle E-Business Suite vulnerability that allows them to execute commands without authentication This article explores oracle ebs faced. . Defused observed the probes, and the vulnerability affects the Core component of Oracle Application Object Library in EBS versions 12.2.3 through 12.2.15.
A crafted request can trigger SQL injection, enabling an attacker to send database commands as the powerful APPS database user.
The impact goes beyond database access; successful exploitation could expose or alter financial, payroll, human resources, and purchasing records accessible via the APPS application. Commands executed using the application account's permissions rather than automatically granting full administrative control over the host. Our Oracle EBS decoys recorded exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in EBS's thin client framework servlet that chains to remote code execution, this morning, October 27.
The bug was recently reported by @horizon3ai, and here's the tweet: "The distinction matters because Oracle EBS has faced damaging attacks before. ZeroOwl documented Cl0p exploiting a separate Oracle EBS zero-day, CVE-2025-61882." That earlier campaign should not be confused with the newly observed TCF servlet probes.
Until then, Horizon3.ai recommends removing the servlet from the EBS URL firewall allowlist and restricting web access to trusted networks. The default URL firewall allows endpoints, necessitating thorough configuration checks.
