Search — “CVE-2026-101767”

Threat intelligence firm Defused reported exploratory exploits against CVE-2026-101767, an unauthenticated SQL injection in the EBS Thin Client Framework servlet that chains to remote code execution, observed on Oct 27 in its decoys. Oracle has not tagged the flaw as exploited in the wild, and Shadowserver tracks over 670 internet-exposed EBS instances without indicating which are patched. Hunters should check for unpatched October 2026 CPU systems and look for requests to the Thin Client Framework servlet carrying SQL injection payloads.

Threat intelligence firm Defused reports that threat actors began probing CVE-2026-101767, an unauthenticated SQL injection in the Application Object Library of Oracle E-Business Suite, patched in the October CPU. Defused observed exploratory attempts against its decoys on October 27, and SecurityWeek reports no other in-the-wild exploitation reports. Hunters should look for HTTP requests to EBS endpoints containing SQL injection patterns and patch the October CPU fix.