Unauthenticated takeover of Oracle E-Business Suite Application Object Library (CVE-2026-101767)
On 2026-10-28 the Canadian Centre for Cyber Security updated its advisory to say the flaw is exploited in the wild, and threat intelligence firm Defused reported attackers scanning for unpatched EBS systems; an internet-facing EBS instance without the October 2026 CPU can be taken over without credentials.
A flaw in the Core component of Oracle Application Object Library in E-Business Suite 12.2.3–12.2.15 lets an unauthenticated attacker with HTTP access take over the component. Public reporting describes it as an unauthenticated SQL injection that can be turned into remote code execution.
Affected: Oracle E-Business Suite – Oracle Application Object Library (Core) 12.2.3 through 12.2.15
How to Test
Check the EBS release level (12.2.3–12.2.15 is affected) and whether the October 2026 Critical Patch Update has been applied to Application Object Library. Review web-tier and application access logs for unauthenticated HTTP requests to EBS endpoints from unfamiliar sources starting around 2026-10-20, and look for unexpected database activity, new accounts or new files on the application tier.
How to Patch
Apply the Oracle Critical Patch Update for October 2026 (released 2026-10-20), which fixes CVE-2026-101767 in Oracle Application Object Library 12.2.3–12.2.15. Until the patch is in place, limit internet access to the EBS web tier so that only trusted networks can reach it.