Attackers begin probing recently patched critical Oracle EBS flaw

· Cybersecurity

Threat actors have begun probing the internet for systems unpatched against a newly fixed critical vulnerability in Oracle E-Business Suite. The flaw, CVE-2026-101767, carries a CVSS score of 9.8 and stems from improper authentication in the Oracle Application Object Library; one report describes it as an unauthenticated SQL injection that can be exploited for remote code execution. Threat intelligence firm Defused Cyber observed the scanning days after Oracle released its security patch. The rapid probing suggests attackers expect the flaw to be exploitable at scale before many organizations complete patching.

Why it matters：Scanning within days of a patch is the standard precursor to mass exploitation, so enterprises running E-Business Suite face a short window to close a remotely exploitable hole at the heart of ERP systems.

Key points

  • CVE-2026-101767 has a CVSS score of 9.8 and involves improper authentication in Oracle Application Object Library.
  • One analysis describes it as an unauthenticated SQL injection enabling remote code execution.
  • Defused Cyber detected the probing days after Oracle issued the patch.

Sources (original reporting)

More stories from this day