Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite

Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.

BoletimSecOctober 29, 2026Translated from Portuguese

Read at source

Threat intelligence company Defused recorded exploitation attempts against CVE-2026-101767 on October 27, 2026, using honeypots that emulate Oracle E-Business Suite installations. The flaw received a CVSS 3.1 score of 9.8, requires no authentication, and was addressed by Oracle seven days earlier in the quarterly Critical Patch Update.

The vulnerability affects the central Application Object Library component and impacts versions 12.2.3 to 12.2.15 of the E-Business Suite. It stems from SQL injection in the Thin Client Framework servlet, reachable over HTTP or HTTPS without valid credentials or user interaction, according to the National Vulnerability Database entry published on October 20.

Chained exploitation extends beyond the database. The injection executes SQL commands under the APPS user account, which holds broad application data access, and this access can be escalated to operating system commands using the application account itself. In practice, attackers can reach financial records, payroll data, and procurement information.

Horizon3.ai reported the issue to Oracle on July 24, 2026, and it remained under coordinated disclosure until the October patch release. The one-week window between patch publication and the first public exploitation attempts on October 27 was classified by Defused as exploratory traffic, with no confirmed successful breaches of customer environments reported as of October 28.

The product’s history increases the assessed risk. Previous critical flaws CVE-2025-61882 and CVE-2026-46817, both scoring 9.8 in the same product, were exploited in campaigns during the past year, with the former used by the Cl0p extortion group. The exposure pattern remains consistent: internet-facing ERP servers with unauthenticated access to the vulnerable endpoint.

Organizations should immediately apply the October 2026 Critical Patch Update to installations running versions 12.2.3 through 12.2.15. Where patching is not immediately feasible, administrators can block the servlet via the E-Business Suite URL firewall, which permits the path by default, as recommended by Horizon3.ai. Detection should focus on unauthenticated POST requests invoking GanttDataServer followed by database queries.

Oracle E-Business Suite Defused CVE-2026-101767 Horizon3.ai CVE-2025-61882

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Telegram for Android Patches Voice Call Vulnerability Enabling Code Execution

Security researchers at NebuSec disclosed a vulnerability in Telegram for Android that allowed remote code execution after a victim answered a voice call. The flaw affected versions from 8.6.2 through 12.10.3 and was fixed in release 12.10.4 at the end of September. The issue stemmed from improper handling of MediaState service messages that carry microphone, camera, and video rotation data during calls. When a required field was missing, the application accessed invalid memory. NebuSec discovered the bug using its Code Security product running on a GPT-5.4 model and confirmed exploitation on ARM64 Android devices for personal calls. A demonstration showed the string “HACKED BY NEBUSEC” appearing roughly 30 seconds after the call was accepted. The vulnerability is unrelated to the earlier animated-sticker attack vector.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Yandex Patches Millions of Stations After eMudhra Certificate Keys Compromised

Yandex has automatically deployed security updates to millions of its smart speakers and partner televisions running YaOS between October 21 and 23. The patches address compromised intermediate certificates issued by eMudhra whose private keys consisted of trivial values from 1 to 255. Attackers who obtained these keys could generate fraudulent certificates and perform man-in-the-middle attacks against device HTTPS traffic. Enthusiasts demonstrated that local network control combined with the certificates allowed replacement of server configuration, activation of ADB, and acquisition of root access on the devices. The update removes trust in the affected certificates, overwrites compromised system files, and disables the debug interface. A factory reset restores the vulnerable firmware, so Yandex advises against resets without a compelling reason.

AntiMalwareOct 29, 2026Translated from Russian

Vulnerabilities & Exploits

Cisco ASA and FTD Face DoS Vulnerability in SSL VPN Already Exploited in the Wild

Cisco Systems has disclosed a denial-of-service vulnerability affecting its Cisco Secure Firewall ASA and Cisco Secure Firewall FTD products. The flaw, tracked as CVE-2026-76418, resides in the SSL VPN remote access feature and carries a CVSS v3.1 base score of 8.6, rated High severity. Exploitation occurs when secondary authentication is configured on tunnel groups, allowing an attacker to send a crafted request that forces a device reboot without requiring authentication. Cisco confirmed active exploitation of the issue in October 2026. Security updates addressing the vulnerability are now available for both affected product lines. The advisory recommends immediate application of the patches to prevent service disruption.

Security NEXTOct 29, 2026Translated from Japanese