What happened

• CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite, rated CVSS 9.8, and was patched in the October Critical Patch Update [S3]
• BleepingComputer places the flaw in the EBS Thin Client Framework servlet and says it chains to remote code execution [S1]
• Threat intelligence firm Defused observed exploratory exploit attempts against its decoys on October 27 [S1][S3]
• SecurityWeek reports no other in-the-wild exploitation reports, and Oracle has not tagged the flaw as exploited [S3][S1]
• Shadowserver tracks over 670 internet-exposed EBS instances, without indicating which are patched [S1]

Timeline

Detect

SQL injection patterns in requests to Oracle EBS web paths · Web server / reverse proxy access logs in front of Oracle EBS

index=* "OA_HTML" | regex _raw="(?i)(union(\s|%20|\+)+select|%27(\s|%20|\+)*or|sleep\(|dbms_|utl_http|chr\(|--(\s|%20))" | stats count min(_time) as first_seen max(_time) as last_seen values(status) as status values(uri_path) as uri_path by src

FROM logs-* | EVAL raw = CONCAT(COALESCE(url.original, ""), " ", COALESCE(url.path, ""), " ", COALESCE(url.query, ""), " ", COALESCE(event.original, "")) | WHERE raw LIKE "*OA_HTML*" AND TO_LOWER(raw) RLIKE ".*(union(\\s|%20|\\+)+select|%27(\\s|%20|\\+)*or|sleep\\(|dbms_|utl_http|chr\\(|--(\\s|%20)).*" | STATS count = COUNT(*), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp), status = VALUES(http.response.status_code), uri_path = VALUES(url.path) BY source.ip

A hit means: A source sent SQL-injection-style payloads to EBS web paths. This is consistent with the probing reported [S1][S3], not proof of compromise. The exact Thin Client Framework servlet path is not given in the sources, so confirm the matched path against Oracle's advisory.

Verify

• Check whether the targeted host was on the October 2026 CPU at the time of the request; an unpatched host raises severity [S1][S3]
• Look at response status and size. Repeated 200 responses with unusual sizes or long response times suggest the injection was processed; uniform errors suggest failed probing
• Check the EBS application server for new processes, files or outbound connections after the request time. The sources say the flaw chains to RCE but give no post-exploitation artefacts [S1]
• Benign look-alikes: authorised vulnerability scanners, penetration tests, WAF test traffic and internet-wide research scanners such as Shadowserver. Match source IPs against those lists first

Scope

Affected

• Oracle E-Business Suite: Application Object Library component per SecurityWeek [S3]; Thin Client Framework servlet per BleepingComputer [S1]

Only if

• The EBS Thin Client Framework servlet is reachable over HTTP from untrusted networks [S1]

Not affected if

• The system has the Oracle October 2026 Critical Patch Update applied [S1][S3]

Fixed in: Oracle October 2026 Critical Patch Update

Enumerate

• All EBS instances (production, DR, test, clones) and their CPU patch level
• Which EBS instances expose web paths to the internet or to partner networks
• Reverse proxies, load balancers and WAFs in front of EBS, and whether their logs are retained back to at least October 20
• Database accounts used by the EBS application tier, which are reachable through SQL injection

Contain

• Restrict internet access to the EBS Thin Client Framework servlet on any instance not yet patched, or block access at the reverse proxy or WAF [S1]
• Apply the October 2026 CPU, internet-facing instances first [S1][S3]
• Before patching or rebuilding a suspected host, preserve web access logs, application server logs and database audit logs. Rebuilding destroys volatile evidence and cannot be undone

Eradicate

• Apply the October 2026 CPU fix [S3]
• If exploitation is confirmed, remove any attacker-created files, accounts or database objects. The sources do not describe persistence, so build the list from the host investigation

Recover

• Validate the patch level on every EBS node before restoring external access
• Rotate EBS database and application credentials if injection succeeded on any host
• Keep the injection hunt running and monitor EBS hosts for unexpected outbound connections after reopening access

Re-enter the loop when

• Oracle or a CERT confirms in-the-wild exploitation, or adds the CVE to an exploited-vulnerabilities list
• A public proof-of-concept or indicators (IPs, payloads, servlet paths) are released
• Reports of actual compromise or post-exploitation activity appear
• Oracle revises the advisory's affected versions or component
• The hunt hits on an unpatched instance

Debrief

• Record when each EBS instance received the October CPU relative to the October 27 probing date [S1][S3]
• Record whether web logs had enough fields (full URI, query, POST body, response size) to detect injection
• Gap: the sources give no indicators, payloads, servlet path or affected version list
• Gap: there is no post-exploitation description for the RCE chain

Detection coverage — checked automatically

Checked automatically 2026-11-10 22:22Z from public sources: 4 published, 23 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2026-101767 — Attackers probe newly patched Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8); no confirmed compromises reported. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-101767

http.title:"Oracle E-Business Suite Login"

http.title:"Oracle E-Business Suite"

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD has not published CPE configurations for these CVEs yet, so only the CVE query is exact; the product queries use the name the campaign gives (Oracle E-Business Suite) and are replaced by NVD's spelling at the daily re-check once it names the software.

Also tried under the name the card uses, nothing matched on Shodan: product:"Oracle E-Business Suite", http.component:"Oracle E-Business Suite", host.services: (software.product = "Oracle E-Business Suite").

Banner spellings: a model read 3 from the NVD names and this card's text (former and marketing names, console titles); 2 matched something on Shodan and are shown above, the rest was dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 22:22Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The sources disagree on the vulnerable component: SecurityWeek says Application Object Library, BleepingComputer says Thin Client Framework servlet. Confirm against Oracle's advisory
• Which EBS versions are affected? None of the sources lists them
• What is the exact URL path of the vulnerable servlet, so the hunt can be narrowed?
• Has Defused published payloads or source IPs?
• The October 20 CPU release date comes from pipeline exposure data, not from a cited source

Sources

• [S1] https://www.bleepingcomputer.com/news/security/hackers-now-scanning-systems-for-recently-patched-oracle-flaw/ · BleepingComputer
• [S2] https://thehackernews.com/2026/10/hackers-target-critical-oracle-e.html · The Hacker News
• [S3] https://www.securityweek.com/hackers-start-probing-fresh-oracle-ebs-vulnerability/ · SecurityWeek

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically; a dismissed draft unpublishes it.