[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQVdkDIvmH4mWkn8jxyIoL0mgD9S5KWn7Rqq4YQ5NpOk":3},{"article":4,"iocs":46,"watch_terms":57,"solutions":58,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"fecd06c5-d531-4ca3-9252-eb8d3b22f4f6","Hackers now scanning systems for recently-patched Oracle flaw","hackers-now-scanning-systems-for-recently-patched-oracle-flaw-cc84d8","Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability. [...]","Threat actors are actively scanning the internet for systems vulnerable to a critical Oracle E-Business Suite (EBS) flaw, CVE-2026-101767. This vulnerability, discovered in the Application Object Library, allows unauthenticated attackers to gain control of systems with minimal effort. Oracle released patches in its October 2026 Critical Security Patch Update, but threat intelligence indicates exploitation attempts are already underway.","Attackers are scanning for unpatched Oracle E-Business Suite systems vulnerable to CVE-2026-101767.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-now-scanning-systems-for-recently-patched-oracle-flaw\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F28\u002FOracle-headpic.jpg","2026-10-28T12:19:57+00:00","2026-10-28T13:00:03.895691+00:00",9,[17,20,23,26],{"name":18,"type":19},"Oracle E-Business Suite","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":25},"Clop","threat_actor",{"name":27,"type":25},"ShinyHunters","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54],{"type":48,"value":49,"context":50},"cve","CVE-2026-101767","Critical Oracle E-Business Suite (EBS) vulnerability.",{"type":48,"value":52,"context":53},"CVE-2025-61882","Previously exploited Oracle EBS vulnerability.",{"type":48,"value":55,"context":56},"CVE-2026-35273","Oracle PeopleSoft Suite zero-day vulnerability.",[21,18],{"controls":59,"vendors":146},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":45,"name":119,"problem":120,"products":121},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[147,153],{"slug":148,"name":149,"logo_path":150,"roles":151},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png",[152],"reported_by",{"slug":154,"name":21,"logo_path":155,"roles":156},"oracle","\u002Fvendor-logos\u002Foracle.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"active-scanning-exploits-unpatched-oracle-ebs-flaw","Active Scanning Exploits Unpatched Oracle EBS Flaw","Threat actors began scanning for systems vulnerable to CVE-2026-101767 almost immediately after Oracle released its Critical Patch Update, demonstrating how quickly attackers operationalize newly disclosed vulnerabilities. The flaw in Oracle's Application Object Library allows unauthenticated attackers to take full control of affected systems, making it exceptionally dangerous for any internet-facing EBS deployments. Organizations that delayed applying the October patch have left a critical business application exposed to trivial, automated exploitation. This incident underscores that the window between patch release and active exploitation is now measured in days or hours, not weeks — making timely patching a non-negotiable security control.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":171,"PCI DSS Requirement 6":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 requires essential and important entities to implement vulnerability handling and disclosure policies; the rapid exploitation of this Oracle flaw illustrates exactly the risk NIS2 aims to mitigate through mandatory patch management practices.","Requirement 6 mandates protecting systems and software from known vulnerabilities through timely patching; any Oracle EBS environment in-scope for PCI DSS would be in violation if this critical patch were not applied promptly.","SI-2 mandates identifying, reporting, and correcting information system flaws promptly; the active scanning campaign directly exploits the gap between patch availability and deployment that this control is designed to close.","CVE-2026-101767 is a textbook A06 scenario where a known vulnerability in a widely-used enterprise component is left unpatched, making the system trivially exploitable by automated scanners.","This control requires establishing a remediation process with defined timelines for critical patches; had organizations applied Oracle's patch within the recommended window, scanning attempts would have found no vulnerable surface.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate measures; applying Oracle's Critical Patch Update promptly is the core action A.8.8 prescribes.","The flaw allows unauthenticated attackers to seize control, highlighting the need for compensating controls such as perimeter restrictions on EBS access that would reduce risk while patches are applied."]