Key points
- The flaw is an unauthenticated SQL injection in the TCF servlet, rated Critical with a CVSS 9.8.
- Versions 12.2.3 through 12.2.15 of Oracle E-Business Suite are affected.
- Oracle released patches in its October 2026 Critical Patch Update.
Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain a critical vulnerability in the Application Object Library. The flaw allows unauthenticated attackers to execute remote code, according to Horizon3.ai. Oracle released patches for this issue in its October 2026 Critical Patch Update.
In plain English
The vulnerability exists in the Thin Client Framework servlet, specifically at the /OA_HTML/AppsTCFServer endpoint. Attackers can send crafted requests over HTTP or HTTPS without needing credentials. This allows them to run SQL commands as the APPS database user.
Horizon3.ai researchers found that this SQL injection can be chained to achieve remote code execution. The attacker gains the ability to run operating system commands with the privileges of the EBS application account. This can lead to full takeover of the application host.
The background
Horizon3.ai disclosed this zero-day flaw to Oracle on July 24, 2026. Oracle subsequently published the patch in its October 2026 advisory. The endpoint is permitted through the default EBS URL firewall configuration, making it accessible to many deployments.
Internet-facing web tiers present the most direct risk. Internal networks are also vulnerable if an attacker can reach the servlet from a compromised system. The flaw affects the oracle.apps.fnd.tcf.SocketServer component.
What changes now
Teams should apply the October 2026 patches immediately. Oracle advises removing the /OA_HTML/AppsTCFServer endpoint from firewall allowlists as a mitigation. Access to the EBS web tier should be restricted to trusted networks.
Monitoring for unexpected files in $APPLPTMP or shell spawns via the Concurrent Manager can help detect exploitation. These measures reduce exposure but do not replace patching.
Who needs to act first
Security teams should prioritize internet-facing Oracle E-Business Suite instances for immediate patching. Before applying updates, verify the patch against a test environment to ensure system stability. Back up configuration files and databases to enable quick recovery if issues arise. If immediate patching is not possible, restrict network access to the vulnerable servlet endpoint using firewalls or web application filters. Monitor logs for unauthorized database queries or unusual process creation. Coordinate with application owners to minimize downtime during the update window.
What to do and how to stay safe: Oracle
- Check your E-Business Suite version and compare it against the affected range of 12.2.3 to 12.2.15.
- Apply the Oracle October 2026 Critical Patch Update as soon as possible.
- Monitor application logs for unauthenticated POST requests to the TCF servlet.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle E-Business Suite versions are affected?
Versions 12.2.3 through 12.2.15 of the Oracle Application Object Library are affected.
Is there a patch available for CVE-2026-101767?
Yes, Oracle released patches in its October 2026 Critical Patch Update.
How can attackers exploit this vulnerability?
Attackers can send unauthenticated requests to the TCF servlet to execute SQL and run operating system commands.
