Oracle E-Business Suite

Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite

Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.

Oracle Releases October 2026 Critical Patch Update Fixing 1,295 Vulnerabilities Across Multiple Products

Oracle has published its quarterly Critical Patch Update (CPU) on October 20, 2026, delivering a total of 1,295 security patches for a wide range of products. After removing duplicates, the update addresses 1,209 unique CVEs. The highest number of fixes went to Oracle Fusion Middleware with 206 patches, followed by Oracle E-Business Suite with 194, Oracle Communications with 110, Oracle MySQL with 98, and Oracle Java SE with 55. Among the vulnerabilities, 587 received a CVSSv3 base score of 7.0 or higher, including 112 rated 9.0 or above. Six vulnerabilities scored the maximum 10.0, one of which is CVE-2026-101809 in Oracle E-Business Suite Workflow Notification Mailer that can be exploited remotely without authentication over HTTP.

Oracle Releases September 2026 Critical Security Patch Update Fixing 673 Issues Across Multiple Products

Oracle has published its monthly Critical Security Patch Update (CSPU) on September 15, 2026, delivering a total of 673 security fixes. The update addresses 672 unique CVEs after removing duplicates and targets a wide range of products including Oracle Database Server, Oracle Fusion Middleware, Oracle E-Business Suite, PeopleSoft, Siebel, and Oracle VM VirtualBox. Of the fixes, 607 received a CVSSv3 base score of 7.0 or higher, with 104 scoring 9.0 or above. Six vulnerabilities carry the maximum score of 10.0, while 15 are rated 9.9 and 44 are rated 9.8. Additionally, 247 of the issues can be exploited remotely without authentication. The CSPU serves as a smaller, more frequent complement to Oracle’s quarterly Critical Patch Update (CPU) releases.

Oracle Releases August 2026 Monthly Security Patches Fixing 943 Vulnerabilities

Oracle has published its monthly Critical Security Patch Update on August 18, 2026, addressing a total of 943 vulnerabilities across a wide range of products. This release supplements the company's quarterly Critical Patch Update and includes fixes for third-party software issues, resulting in 925 unique CVEs after removing duplicates. Of these, 710 vulnerabilities received CVSSv3 base scores of 7.0 or higher, with 154 scoring 9.0 or above, including three at the maximum 10.0. A total of 467 flaws can be exploited remotely without authentication. Major products affected include Oracle Fusion Middleware with 262 patches, Oracle E-Business Suite with 120 fixes, and Oracle Database Server with six updates. The next monthly update is scheduled for September 15, 2026, followed by the quarterly release on October 20.