Hackers now scanning systems for recently-patched Oracle flaw

Internet scanning means attackers are sending probes across reachable IP addresses and services, looking for Oracle EBS systems that respond in ways associated with CVE-2026-101767. The goal is to identify exposed targets before attempting a full compromise. Scanning can be automated and cover many organizations quickly.

Defused said its Oracle EBS decoys recorded exploratory exploits against the vulnerability. The flaw is an unauthenticated SQL injection in the EBS Thin Client Framework servlet. Attackers do not need an account to test it, and the injection can chain to remote code execution.

Shadowserver tracks more than 670 Internet-exposed Oracle EBS instances, although it does not show which are honeypots or already patched. The activity makes immediate patching important because scanning can precede broader exploitation. Oracle released fixes on October 20 and urged customers to apply them without delay.

Oracle E-Business Suite, or EBS, is a business software suite organizations use to support core operations. The article identifies its Application Object Library and Thin Client Framework as important components. Because EBS can sit inside large enterprise environments, compromising it can affect more than one isolated application.

CVE-2026-101767 affects a core EBS component and allows unauthenticated attackers with HTTP network access to take over vulnerable systems. The flaw uses SQL injection in the Thin Client Framework servlet and can chain to remote code execution. That gives an attacker a path from a web request to control of the server.

The risk is significant because Oracle systems are used across Fortune 100 corporations, government organizations, and healthcare networks. Earlier attacks also affected companies, universities, and other institutions. A compromised EBS system could therefore become a foothold for data theft, disruption, or extortion, although the article does not detail every possible post-compromise action.

Shadowserver’s count measures Oracle E-Business Suite instances visible from the public Internet. These systems may be reachable by attackers, which makes them relevant to the newly disclosed vulnerability. Internet exposure does not prove that every instance is vulnerable, compromised, or even a production system.

The watchdog tracks over 670 such instances, and most have IP addresses from the United States. That figure gives defenders a sense of the potential exposure, but it is not a confirmed victim count. Shadowserver does not indicate how many systems are honeypots or have already been secured.

The practical concern is that exposed systems can be found through automated scanning. Defused has already reported exploratory exploit activity against the flaw. Oracle released security updates on October 20, so organizations should determine whether their EBS systems are affected and apply the relevant update. The article does not provide a smaller count of confirmed unpatched systems.

CVE-2026-101767 removes the need for a valid username and password when the vulnerable EBS service is reachable over HTTP. Oracle describes the flaw as allowing unauthenticated threat actors with HTTP network access to take over vulnerable systems through a low-complexity attack.

Defused described the issue more specifically as an unauthenticated SQL injection in the EBS Thin Client Framework servlet. SQL injection lets crafted input interfere with database commands. In this case, the attack can chain from database manipulation to remote code execution, meaning the attacker can make the server run code of the attacker’s choice.

That combination makes the flaw especially serious: it is remotely reachable, does not require authentication, and can lead to system takeover. Oracle fixed it in the October 2026 Critical Security Patch Update, released October 20. Defused later saw exploratory exploits, while Oracle had not yet labeled the vulnerability exploited in the wild.

Installing Oracle’s security update reduces risk because it changes the vulnerable EBS software to address CVE-2026-101767. Without the fix, a reachable system may accept the attack path described by Defused. That path begins with unauthenticated SQL injection and can end in remote code execution.

Oracle included the fix in its October 2026 Critical Security Patch Update, released on October 20. The company urged customers to patch immediately and strongly recommended using actively supported versions. Applying the update closes the specific weakness addressed by Oracle, rather than merely detecting suspicious activity after an attack begins.

Patching is urgent because Defused reported exploratory exploits on October 27, and Shadowserver tracks over 670 exposed EBS instances. The article does not say how many systems remain vulnerable, so each organization must assess its own environment. Updates lower exposure, but the article also emphasizes staying on supported versions and applying patches without delay.

Oracle vulnerabilities have previously provided attackers with routes into organizations that depend on Oracle enterprise software. Since early August 2025, the Clop extortion gang exploited EBS flaw CVE-2025-61882 in zero-day attacks. The reported victims included Logitech, GlobalLogic, the Washington Post, and several US universities.

A separate PeopleSoft Suite flaw, CVE-2026-35273, was exploited by the ShinyHunters extortion gang between May 27 and June 9. Oracle issued emergency mitigations in June. By abusing that flaw, the attackers gained unauthenticated remote code execution and stole data from organizations including Nottingham University, Nissan, and the National Association of Insurance Commissioners.

These incidents show why new Oracle vulnerabilities receive attention from attackers. The article says Oracle products are present across Fortune 100 companies, government organizations, and healthcare networks. It also reports that CISA has listed 46 Oracle security bugs as actively exploited since November 2021, including 13 abused in ransomware attacks.

SQL injection happens when an application places untrusted input into a database query without safely separating data from commands. An attacker can craft input that changes the query’s meaning. Depending on the application and database permissions, this may expose, alter, or delete data. This general explanation uses established security knowledge; the article specifically identifies CVE-2026-101767 as an unauthenticated SQL injection.

The Oracle flaw affects the Thin Client Framework servlet. Defused said attackers can use the injection as the first step in a chain to remote code execution. That means the database-level foothold can reach functionality that causes the server itself to execute commands or code.

Remote code execution is more severe than database access alone because it can provide control of the vulnerable host. In this case, the article says the attack requires no authentication and can take over vulnerable systems through HTTP access. Oracle patched the issue on October 20, while Defused later observed exploratory exploits.