Attackers have begun probing CVE-2026-101767, a critical SQL injection flaw in Oracle E-Business Suite that Oracle patched only last week. Threat intelligence firm Defused reported exploratory attempts against its Oracle EBS decoy systems on October 27.
What Defused Observed Against Oracle EBS Decoys
Defused said the activity it recorded was exploratory, meaning attackers were testing the vulnerability rather than carrying out confirmed intrusions. The firm saw the attempts on decoy systems that imitate Oracle E-Business Suite installations, which are set up to attract and record scanning and exploitation traffic.
There are no other reports of in-the-wild exploitation so far. The Defused observation is, for now, the only public sign that attackers have taken an interest in the flaw.
Technical Profile of the CVE-2026-101767 SQL Injection
The vulnerability is an SQL injection in the Application Object Library component of Oracle E-Business Suite. It carries a CVSS score of 9.8.
Unauthenticated HTTP Access and Component Takeover
A remote attacker without credentials can exploit the flaw over HTTP. Successful exploitation can lead to remote code execution and takeover of the affected component. The combination of no authentication requirement and network reachability over a standard web protocol is what places the score near the top of the scale.
Discovery by Horizon3.ai and Oracle’s October Patch
Horizon3.ai discovered the flaw and reported it to Oracle. Oracle fixed it in its October Critical Patch Update, which shipped the week before the probing began. The gap between patch release and the first observed scanning was about a week.
Oracle EBS as a Repeated Attack Target
Oracle E-Business Suite has drawn attention from attackers before. In June, Defused warned about attacks on a separate flaw, CVE-2026-46817. Last year the Cl0p group exploited Oracle zero-days in a campaign that affected more than 100 organizations.
Those earlier events give the new probing added context. Enterprise resource planning platforms hold financial, supplier and personnel records, and groups that run data-theft extortion campaigns have shown interest in them. Cl0p’s campaign is the clearest example in the source reporting of a group turning an Oracle EBS weakness into a mass-victim operation.
Why a One-Week Patch Gap Matters
Probing within days of a patch is a familiar pattern. Once a fix ships, attackers and researchers can compare patched and unpatched code to understand the flaw, and scanning for exposed systems often follows. Defused’s decoys recorded the early stage of that process.
Organizations that run internet-facing EBS servers and have not installed the October update remain exposed to unauthenticated remote code execution if the exploratory attempts mature into working attacks. Oracle has made the patch available in the October 2026 Critical Patch Update.
Outlook for Unpatched EBS Servers
Defused’s report does not say who is behind the probing or whether any attempt succeeded. Nor does it describe a public proof-of-concept exploit. Those unknowns define the near-term risk: the vulnerability class is well understood, the entry point is a web request, and the target software has a documented history of mass exploitation.
If the probing is followed by confirmed intrusions, it would add CVE-2026-101767 to a list of Oracle EBS flaws that moved from patch to exploitation within weeks. Until then, the Defused observation is the only evidence available that the October fix is attracting attacker attention.
The disclosure also leaves a detail unresolved: Defused saw the attempts only on decoys, so it is not known whether real servers received similar traffic. Decoys provide an early warning because attackers scanning the internet cannot tell them apart from production systems. The report describes a single day of probing and no pattern over time, which means the scale of attacker interest is not yet measurable. Oracle’s October update is the only fix referenced in the reporting.
