[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fcW3LaJofaOuObJPk6zb7mH8m1UTVLVoOp7sze-nVwhk":3},{"article":4,"iocs":50,"watch_terms":58,"solutions":59,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"0480c40c-e231-4110-a06c-249a7bf7d64c","Hackers Start Probing Fresh Oracle EBS Vulnerability","hackers-start-probing-fresh-oracle-ebs-vulnerability-8816f0","CVE-2026-101767 is an unauthenticated SQL injection that can be exploited for remote code execution. The post Hackers Start Probing Fresh Oracle EBS Vulnerability appeared first on SecurityWeek.","Threat actors are actively probing for CVE-2026-101767, a critical SQL injection vulnerability in Oracle E-Business Suite (EBS) that allows for remote code execution. The flaw, patched in Oracle's October CPU, was discovered by Horizon3.ai and is being exploited by unauthenticated attackers. This follows a history of Oracle EBS vulnerabilities being targeted, including a large-scale campaign last year that impacted numerous organizations.","Hackers probe critical Oracle EBS SQL injection vulnerability CVE-2026-101767.","https:\u002F\u002Fwww.securityweek.com\u002Fhackers-start-probing-fresh-oracle-ebs-vulnerability\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F10\u002FOracle-E-Business-Suite.jpeg","2026-10-28T09:14:23+00:00","2026-10-28T10:00:09.9846+00:00",8,[17,20,23,25],{"name":18,"type":19},"Oracle E-Business Suite","product",{"name":21,"type":22},"Oracle","vendor",{"name":24,"type":19},"Application Object Library",{"name":26,"type":22},"Horizon3.ai","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,55],{"type":52,"value":53,"context":54},"cve","CVE-2026-101767","Critical SQL injection vulnerability in Oracle EBS",{"type":52,"value":56,"context":57},"CVE-2026-46817","Previously exploited critical vulnerability in Oracle EBS File Transmissions component",[21,26,18],{"controls":60,"vendors":147},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":49,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[148,153],{"slug":149,"name":26,"logo_path":150,"roles":151},"horizon3-ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[152],"reported_by",{"slug":154,"name":21,"logo_path":155,"roles":156},"oracle","\u002Fvendor-logos\u002Foracle.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"active-exploitation-of-unpatched-oracle-ebs-sql-injection-flaw","Active Exploitation of Unpatched Oracle EBS SQL Injection Flaw","A critical SQL injection vulnerability (CVE-2026-101767) in Oracle E-Business Suite is being actively probed by threat actors, despite a patch being available since Oracle's October Critical Patch Update. The flaw allows unauthenticated attackers to achieve remote code execution, placing unpatched systems at immediate and severe risk. This incident highlights a recurring pattern of Oracle EBS vulnerabilities being targeted at scale, suggesting organizations are consistently slow to apply vendor-issued patches to business-critical ERP systems. The window between patch release and active exploitation continues to shrink, making timely remediation a non-negotiable security discipline.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":171,"PCI DSS Requirement 6":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, including timely patching of critical systems such as ERP platforms exposed to active exploitation.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches promptly, which is directly violated when a critical vendor patch for an internet-accessible system goes unapplied during active scanning campaigns.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined timeframes — directly applicable to the failure to patch a critical Oracle EBS vulnerability after its public disclosure.","Running an unpatched version of Oracle EBS with a known critical SQL injection flaw is a textbook instance of the Vulnerable and Outdated Components risk, which OWASP flags as a top web application security failure.","The patch was available at the October CPU release; a mature vulnerability management program with enforced patching deadlines would have closed this flaw before active probing began.","This control mandates timely identification and remediation of technical vulnerabilities in used software, which would have driven prompt application of Oracle's CPU patch before exploitation activity began.","The vulnerability allows exploitation by unauthenticated attackers; enforcing strict authentication controls and network-level access restrictions on Oracle EBS would have reduced the attack surface even before patching."]