Oracle released a Critical Patch Update earlier this month to address a raft of security vulnerabilities across its ecosystem, but one vulnerability in particular is already drawing the attention of malicious actors.
CVE-2026-101767 is a critical unauthenticated SQL injection flaw in Oracle’s E-Business Suite (EBS) that can be chained to remote code execution.
⠀
The vulnerability has a CVSS score of 9.8 and impacts E-Business Suite versions 12.2.3 through 12.2.15.
The vulnerability’s CVE calls the bug “easily exploitable”, and that appears to be what many hackers are hoping for. However, despite the severity of the issue, Oracle is continuing to urge customers to apply the latest security patch.
“Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches,” the company said in its patch update.
“In some instances, it has been reported that attackers have been successful because targeted customers had failed to apply available Oracle patches. Oracle therefore strongly recommends that customers remain on actively-supported versions and apply security patches without delay.”
According to security researchers, there are more than 670 internet-exposed EBS instances, although their patch status is unknown, with hackers actively looking for vulnerable deployments.
Jim Sherlock, vice president of AI and cyber security R&D at ProCircular, said that hackers were already “firing exploits at decoy E-Business Suite servers” within seven days of the patch being released.
“CISA’s own analysis already rates the bug as easy to automate with total impact on the system, so the only thing keeping it off the federal list of exploited vulnerabilities is a confirmed victim,” Sherlock told Cyber Daily.
“EBS is where companies keep payroll, HR records, supplier payments and the general ledger, and last year an extortion gang used a different flaw in Oracle EBS to hit Harvard, The Washington Post, and Logitech.
“The hard case is a company that can’t take EBS down until month-end close is done. That is the argument for a web application firewall in front of EBS and anything like it on the internet. When a bug like this drops, a rule blocking the one vulnerable component can go in within hours while the rest of EBS keeps running, and the patch becomes a planned event instead of an emergency. Planned does not mean optional.
“A month ago, the ShinyHunters gang went back to PeopleSoft servers whose owners had relied on a WAF rule instead of patching, and got past it by changing one character in the request. Treat the rule as borrowed time and put the patch date on the calendar the day it goes in. That cushion looks thin right now. A Shodan search I ran this morning found about 560 EBS servers exposed on the internet, nearly 250 in the US, and Shodan was able to detect a web application firewall in front of fewer than one in 10.
“It’s important to keep in mind that the patch won’t tell you whether anyone got in during the gap. This particular exploit ends with the EBS account running operating system commands, so before you close it out, have someone compare what that account ran over the past week against the jobs it normally runs.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
