Oracle's Oct 2026 CPU Patches Critical Unauthenticated SQLi in E-Business Suite Enabling Remote Code Execution

Oracle has released patches for a critical vulnerability in E-Business Suite that allows unauthenticated remote code execution. The flaw affects versions 12.2.3 through 12.2.15 and involves the Thin Client Framework servlet.

What happened

Horizon3.ai researchers identified CVE-2026-101767 as an unauthenticated SQL injection vulnerability in Oracle E-Business Suite. The flaw resides in the Thin Client Framework (TCF) servlet, specifically at the /OA_HTML/AppsTCFServer endpoint. This endpoint is typically permitted through default EBS URL firewall configurations, making it accessible to attackers with network access.

The vulnerability allows an attacker to execute SQL commands with the privileges of the APPS database user. Horizon3.ai’s analysis shows that this SQL injection can be chained to achieve remote code execution. Attackers can run operating system commands with the privileges of the EBS application account. The CVSS 3.1 base score is 9.8, indicating critical severity with high impacts on confidentiality, integrity, and availability.

Oracle addressed the issue in its October 2026 Critical Patch Update, released on October 20, 2026. The company identifies the affected product as the Oracle Application Object Library, Core component. Exploitation requires only network access over HTTP or HTTPS, with no authentication or user interaction needed.

Why it matters

Successful exploitation allows attackers to read or modify application data accessible to the APPS user. This data may include sensitive financial, payroll, human resources, and procurement records. Operating system access is governed by the permissions of the compromised EBS application account, potentially leading to full host takeover.

Internet-facing EBS web tiers present the most direct exposure to this threat. Internal deployments are also at risk if an attacker can reach the vulnerable servlet from a compromised system. Horizon3.ai disclosed the zero-day flaw to Oracle on July 24, 2026. The vendor subsequently published the advisory and patches in October 2026.

What to watch

• Look for unauthenticated POST requests to the /OA_HTML/AppsTCFServer endpoint that instantiate the Gantt data-server class.
• Monitor for SQL reconnaissance activity shortly after unauthenticated web requests, such as queries for database versions.
• Check for unexpected files in the $APPLPTMP directory or the oracle account spawning shell processes via the Concurrent Manager.

Who needs to act first

Teams should prioritize internet-facing EBS web tiers for immediate patching, as these systems present the most direct exposure to unauthenticated attacks. Internal deployments should also be updated promptly if the TCF servlet is accessible from other network segments. Before applying patches, verify compatibility with your specific installation using Oracle’s documentation.

Remove the vulnerable servlet from firewall allowlists to reduce exposure while testing updates. Restrict access to the web tier to trusted networks only. Monitor application hosts and databases for signs of compromise, such as unexpected command executions or data modifications. These steps help mitigate risk before and during the patching process.

What to do and how to stay safe: Oracle

• Apply the October 2026 Critical Patch Update patches to all Oracle E-Business Suite installations running versions 12.2.3 through 12.2.15.
• Restrict access to the EBS web tier to trusted networks to limit exposure from untrusted network paths.
• Monitor EBS application hosts and databases for signs of compromise, such as unexpected command executions or data modifications.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Oracle E-Business Suite versions are affected by CVE-2026-101767?

Versions 12.2.3 through 12.2.15, inclusive, are affected by this unauthenticated SQL injection vulnerability.

Is there a patch available for this vulnerability?

Yes, Oracle addressed CVE-2026-101767 in its October 2026 Critical Patch Update, released on October 20, 2026.

What is the CVSS score for this vulnerability?

The CVSS 3.1 base score is 9.8, which is classified as critical severity.