Skip to content
Critical SQL Injection Flaw in Oracle E-Business Suite Disclosed

Critical SQL Injection Flaw in Oracle E-Business Suite Disclosed

First seen 21 Oct 2026, 19:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 21:09 UTC
  • •CVE-2026-101767 is a critical SQL injection vulnerability with a CVSS score of 9.8.
  • •The flaw allows unauthenticated attackers to execute SQL commands and OS commands remotely.
  • •A patch is available, but as of October 21, 2026, there are no confirmed exploitations in the wild.

Oracle has addressed CVE-2026-101767, a critical unauthenticated SQL injection vulnerability in the Oracle Application Object Library of Oracle E-Business Suite (EBS). The flaw, rated CVSS 3.1 9.8 (Critical), allows attackers with network access to exploit the EBS Thin Client Framework (TCF) servlet to execute SQL as the APPS database user and run operating system commands. Affected versions include EBS 12.2.3 through 12.2.15. The vulnerability was reported by Horizon3.ai, and while a patch is available from the October 2026 Critical Patch Update released on October 20, 2026, no exploitation in the wild has been confirmed as of October 21, 2026. The potential impact includes access to sensitive data such as financial and HR records. Oracle has not published detailed technical information about the flaw.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-10-05
CVE-2025-61882 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-28
CVE-2026-46817 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-20
Oracle releases patch for CVE-2026-101767
Oracle's October 2026 Critical Patch Update addresses the critical SQL injection vulnerability in EBS.
Horizon3.Ai
2026-10-20
CVE-2026-101809 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-21
CVE-2026-101767 disclosed
Horizon3.ai reports on the critical vulnerability allowing SQL injection and OS command execution.
Horizon3.Ai

More articles in this cluster (3)

Following this threat?

Track Oracle and CVE-2025-61882 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

Which versions of Oracle EBS are affected?
Oracle E-Business Suite versions 12.2.3 through 12.2.15 are affected by CVE-2026-101767.
What is the nature of the vulnerability?
CVE-2026-101767 is an unauthenticated SQL injection vulnerability that can lead to remote code execution.
What should organizations do to mitigate this risk?
Organizations should apply the October 2026 Critical Patch Update to remediate the vulnerability.