[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmGVuBxs5uRqBptAsmN0g5VOlhsoGLgLHKF8q6tOweec":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"7bf343b6-abe4-4b44-b3be-a36587beba8c","Hackers Actively Exploiting New Oracle EBS RCE Vulnerability","hackers-actively-exploiting-new-oracle-ebs-rce-vulnerability-5c17b2","Hackers have begun testing a critical Oracle E-Business Suite vulnerability that can let them run commands without logging in. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026. However, these observations do not confirm successful attacks against customer systems, and Oracle had already released a patch before the […] The post Hackers Actively Exploiting New Oracle EBS RCE Vulnerability appeared first on Cyber Security News.","Hackers have been observed testing a critical Oracle E-Business Suite vulnerability (CVE-2026-101767) that allows for unauthenticated remote code execution. Threat intelligence firm Defused reported exploratory exploit attempts against its decoy systems on October 27, 2026. While these attempts do not confirm successful breaches, Oracle had already released a patch for the vulnerability, discovered by Horizon3.ai, in its October Critical Patch Update.","Hackers are testing a critical Oracle EBS RCE vulnerability, CVE-2026-101767, which was patched in October.","https:\u002F\u002Fcybersecuritynews.com\u002Foracle-ebs-rce-exploited\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FOracle-EBS-RCE-Vulnerability.webp","2026-10-28T10:38:25+00:00","2026-10-28T11:00:15.585656+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Oracle E-Business Suite","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":19},"Thin Client Framework",{"name":26,"type":22},"Defused",{"name":28,"type":22},"Horizon3.ai","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,40,42],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":29,"icon":31,"name":32,"slug":33},{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"cve","CVE-2026-101767","Critical Oracle EBS RCE vulnerability",[21,26,28],{"controls":54,"vendors":140},[55,84,112],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":85,"name":86,"problem":87,"products":88},"patch-management","Automated patch management","Known holes get closed in days, not months.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":85,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":46,"name":113,"problem":114,"products":115},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[141,146,150],{"slug":142,"name":26,"logo_path":143,"roles":144},"defused","\u002Fvendor-logos\u002Fdefused.png",[145],"reported_by",{"slug":147,"name":28,"logo_path":148,"roles":149},"horizon3-ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[145],{"slug":151,"name":21,"logo_path":152,"roles":153},"oracle","\u002Fvendor-logos\u002Foracle.png",[154],"affected",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"oracle-ebs-rce-flaw-actively-probed-before-patch-adoption","Oracle EBS RCE Flaw Actively Probed Before Patch Adoption","Attackers began probing CVE-2026-101767 in Oracle E-Business Suite almost immediately after its public disclosure, even though Oracle had already shipped a fix in its October Critical Patch Update. The vulnerability allows unauthenticated remote code execution, meaning any internet-facing EBS instance without the patch is fully exposed without requiring valid credentials. This incident illustrates the dangerously short window between patch release and active exploitation, often measured in days rather than weeks. Organizations that lack a disciplined, prioritized patching process for critical enterprise applications hand attackers a predictable and exploitable gap.",[160,161,162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":168,"PCI DSS Requirement 6":169,"NIST SP 800-53 SI-2: Flaw Remediation":170,"OWASP A06:2021 Vulnerable and Outdated Components":171,"CIS Control 7: Continuous Vulnerability Management":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including timely patching of critical systems like EBS.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities by installing applicable security patches within defined timelines, covering exactly this scenario.","SI-2 requires organizations to identify, report, and correct information system flaws within defined time frames, directly addressing the failure to rapidly deploy Oracle's available patch.","Running an unpatched Oracle EBS version with a known critical RCE is a textbook instance of using a vulnerable component that OWASP A06 specifically warns against.","A formal vulnerability management program with defined patching SLAs would have ensured the Oracle patch was applied before active exploitation attempts began.","This control mandates timely identification and remediation of technical vulnerabilities, which would have driven urgent patching of the critical EBS RCE flaw upon its disclosure.","Because the vulnerability allows unauthenticated RCE, enforcing strict network-level access controls and authentication gateways in front of EBS would have limited exposure even before the patch was applied."]