Attackers started knocking on Oracle E-Business Suite deployments within a day of the October Critical Patch Update, according to threat intelligence firm Defused Cyber.
The target is CVE-2026-101767, a 9.8 flaw that stems from weak authentication in the Application Object Library. Horizon3.ai researchers Brandon Peterson, Jimi Sebree and Noah King reported it to Oracle on July 24.
Horizon3 describes the chain plainly. A request to the Thin Client Framework servlet at /OA_HTML/AppsTCFServer runs SQL as the APPS database user, and from there the attacker can execute operating system commands as the EBS application account. Defused Cyber said its decoys saw exploratory attempts this week.
What that buys an intruder depends on the deployment. Records reachable by APPS commonly include financial, payroll, HR and procurement data, and command execution is bounded only by the permissions of the application account.
Internet-facing instances carry the obvious risk, but the firm warns that internal systems are reachable too, since any foothold on an adjacent segment can serve as a launch point.
Where patching cannot happen immediately, three mitigations apply. Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restrict web tier access to trusted networks, and monitor the application host and database for signs of compromise.
The reconnaissance arrives after exploitation attempts have already begun, which puts defenders in the reactive position of proving a negative rather than blocking a first probe.
Given the volume of Oracle fixes shipped this month, teams should confirm which EBS instances actually received the October update rather than assuming a fleet-wide patch run covered them.
