Oracle EBS Flaw CVE-2026-101767 Under Active Exploitation

On 27 October 2026, security telemetry recorded active exploratory probing targeting a critical oracle ebs vulnerability catalogued as CVE-2026-101767. The unauthenticated remote code execution flaw in the suite’s Application Object Library carries a maximum-severity CVSS score of 9.8 and affects Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15. Originally discovered and reported to Oracle on 24 July 2026 by Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King, the underlying flaw was officially patched in the 20 October 2026 Oracle Critical Patch Update (CPU).

The onset of active probing against EBS instances coincides with detailed technical disclosures surrounding Oracle PeopleSoft environments, where a multi-stage attack chain tracked under CVE-2026-35273 has seen zero-day exploitation by threat actors since May 2026. According to technical reporting by The Register, initial access campaigns against enterprise resource planning (ERP) infrastructure frequently transition into long-term persistence through embedded web shells, leaving unmonitored deployments vulnerable even after vendor patches have been applied.

Enterprise ERP systems sit at the center of core business operations, managing sensitive records across payroll, procurement, human resources, and financial ledgers. This technical analysis deconstructs the underlying mechanics of both CVE-2026-101767 and the PeopleSoft three-bug chain, outlining explicit detection queries, log indicators, and defense-in-depth mitigation strategies for platform engineering, security engineering, and incident response teams. Additional architectural context on enterprise system vulnerabilities can be found in our technical breakdown of Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains.

Active Probing Targets Critical Oracle EBS Vulnerability CVE-2026-101767

According to telemetry data released by security firm Defused, honeypot decoys recorded exploratory exploit attempts targeting CVE-2026-101767 on the morning of 27 October 2026. Prior to this telemetry capture, no public reports of active exploitation attempts against the flaw had been recorded. The precise threat actor group responsible for these 27 October exploratory probes remains unconfirmed in public telemetry.

Catalogued with a CVSS v3.1 base score of 9.8 (Critical), CVE-2026-101767 represents an easily exploitable flaw accessible over HTTP without requiring user interaction or prior authentication. The flaw resides within the Application Object Library (AOL) component, a core foundational module in Oracle EBS that provides shared data structures, security controls, and application architecture interfaces. The vulnerability affects Oracle EBS releases 12.2.3 through 12.2.15.

The timeline of discovery and disclosure spans three months:

• 24 July 2026: Horizon3.ai researchers Brandon Peterson, Jimi Sebree, and Noah King identify the vulnerability and submit a formal disclosure to Oracle.
• 20 October 2026: Oracle publishes its quarterly Critical Patch Update, supplying security updates for affected EBS modules.
• 27 October 2026: Defused detects initial exploratory probes against internet-accessible decoys.
• 28 October 2026: Censys issues an exposure advisory documenting internet-accessible EBS endpoints.
• 29 October 2026: Help Net Security publishes details confirming active honeypot probes and emergency mitigation guidance.

Technical Mechanics of CVE-2026-101767: From SQLi to OS RCE

The core vector of CVE-2026-101767 lies within the Thin Client Framework (TCF) servlet, exposed via the HTTP URI endpoint /OA_HTML/AppsTCFServer. The TCF servlet was designed to facilitate communication between client-side Java applets and server-side database tiers. Due to insufficient input sanitisation within the processing handlers of AppsTCFServer, an unauthenticated remote attacker can inject arbitrary SQL commands directly into backend database calls.

In standard Oracle EBS deployments, requests handled by application servlets execute in the context of the APPS database schema user. The APPS account is an ultra-privileged schema that maintains full data manipulation and data definition rights across all operational business data, including core tables in financial management, payroll, human resources, supply chain, and procurement suites.

The vulnerability sequence allows an attacker to pivot from a web-tier SQL injection payload to complete operating system command execution on the EBS application host through a multi-stage execution chain:

+------------------+         HTTP Request (Malicious Payload)      +-----------------------+
| Unauthenticated  | --------------------------------------------> | /OA_HTML/AppsTCFServer|
| Remote Attacker  |                                               | Thin Client Framework |
+------------------+                                               +-----------------------+
                                                                               |
                                                                     Unsanitised SQL Parameter
                                                                               v
+------------------+           Operating System Commands           +-----------------------+
| EBS Host Server  | <-------------------------------------------- | Oracle Database Tier  |
| OS Execution Context                                             | APPS Schema Privilege |
+------------------+                                               +-----------------------+

The execution workflow functions as follows:

1. Initial Injection: An HTTP request containing crafted input parameters is transmitted to the /OA_HTML/AppsTCFServer endpoint without requiring session tokens or authentication headers.
2. SQL Context Execution: The servlet parses the parameters and executes dynamic SQL within the Oracle Database using the broad grants of the APPS schema user.
3. Database-to-OS Pivot: Leveraging the database privileges of APPS, the attacker invokes database packages, Java stored procedures, or built-in system tasks (such as DBMS_SCHEDULER or custom executable wrappers) configured to interface with the host operating system.
4. Host Command Execution: System commands execute on the underlying application server under the security context of the EBS application OS user account (typically applmgr).

The data at risk encompasses the entirety of the enterprise database accessible to APPS. Unauthorised modifications or exfiltration can compromise corporate financial statements, vendor banking details, employee personally identifiable information (PII), salary structure data, and enterprise intellectual property stored within procurement databases.

PeopleSoft CVE-2026-35273 Analysis: Dissecting the Three-Bug Chain

While EBS vulnerability probes escalated, technical details emerged regarding a parallel attack vector targeting Oracle PeopleSoft environments. TrendAI’s Zero Day Initiative (ZDI) researchers Bobby Gould, Minh Giang, and Lucas Miller discovered and reported three distinct vulnerabilities to Oracle on 10 June 2026. Oracle addressed these flaws in its patch release, grouping all three issues under a single identifier: CVE-2026-35273.

ZDI researchers noted that combining these three distinct flaws produces a reliable, unauthenticated remote code execution chain against PeopleSoft installations. ZDI is coordinating with Oracle regarding potential retroactive assignment of separate CVE identifiers for each component bug, though Oracle has not publicly confirmed separate assignments.

Bug 1: Server-Side Request Forgery in PeopleSoft Integration Gateway (PSIGW)

The initial access vector relies on a Server-Side Request Forgery (SSRF) flaw in the PeopleSoft Integration Gateway (PSIGW) web application. In June 2026, Oracle introduced a validateClient security method designed to allow administrators to restrict access to specific sensitive gateway functions.

However, the implementation contains a logic vulnerability that allows remote attackers to craft HTTP requests that bypass the validateClient check. Because Oracle configurations permit localhost connections by default, the SSRF vulnerability enables an external, unauthenticated attacker to route traffic through the local loopback interface (127.0.0.1), gaining unrestricted access to internal administration servlets, specifically the PeopleSoft Environment Management Hub (PSEMHUB).

Bug 2: Path Control File-Write Vulnerability in PSEMHUB

Once internal access to PSEMHUB is established via the PSIGW SSRF, the second vulnerability targets the ExecuteProcessActivityCommand message handler in PSEMHUB. This handler was designed to allow administrative clients to write execution and diagnostic logs to the local filesystem of the PeopleSoft server.

The message handler fails to validate directory paths and filenames provided in incoming requests. An attacker can supply arbitrary directory traversal sequences to bypass expected log directories, writing arbitrary content—such as Java Server Pages (JSP) web shells—directly into publicly accessible web root directories. This grants immediate HTTP-accessible command execution on the host server.

Bug 3: Untrusted XML Deserialization in PSEMHUB

The third flaw in the chain involves untrusted XML data deserialization within PSEMHUB’s environment configuration handler. By using Bug 2 (the file path control vulnerability), an attacker can drop a malicious XML configuration file into a specific system directory designated for PeopleSoft environment metadata.

When the PSEMHUB service initialises—such as during a scheduled system reboot, an automated cluster sync, or a service restart—it parses and deserializes the malicious XML file. The deserialization sequence triggers arbitrary code execution within the Java virtual machine (JVM) context of the PeopleSoft application server, providing a persistent secondary execution pathway even if direct web access to the shell is interrupted.

Threat Actor Campaigns: ShinyHunters, Cl0p, and Web Shell Persistence

The targeting of core enterprise ERP engines reflects an ongoing trend among financially motivated threat actors and ransomware syndicates. Zero-day exploitation of the PeopleSoft bug chain began in May 2026, when the threat group ShinyHunters leveraged the chain against more than 100 organisations globally.

Security investigations by Mandiant confirmed that zero-day exploitation initially targeted educational institutions before expanding significantly into autumn 2026. Mandiant observed active web shell deployments across multiple industry sectors, including higher education, technology, IT services, healthcare, agriculture, transportation, and government agencies.

This operational pattern parallels previous campaigns targeting Oracle ERP software:

• 2025: The Cl0p extortion group exploited CVE-2025-61882 as an EBS zero-day flaw to exfiltrate enterprise database contents from target organisations.
• June 2026: Defused recorded active exploitation probes targeting CVE-2026-46817, an RCE vulnerability in the Oracle Payments module.
• October 2026: Exploratory probes targeting CVE-2026-101767 emerged within days of public patch disclosure.

A critical operational takeaway for incident responders is that vendor patch deployment is purely prospective: it remediates code vulnerabilities to prevent future access but does not inspect, isolate, or delete artifacts created during prior compromises.

Attackers who successfully leveraged the PeopleSoft chain prior to patching routinely dropped JSP web shells in web application root paths or staged malicious XML files in configuration directories. Applying the October 2026 CPU patches the input sanitisation flaws in PSIGW and PSEMHUB, but leaves existing web shells fully functional and accessible over HTTP if their file paths are known to the attacker.

Internet Exposure and Blast Radius Across Enterprise Infrastructure

In an exposure advisory released on 28 October 2026, internet scanning entity Censys documented 2,246 internet-accessible web properties running Oracle E-Business Suite instances.

Security teams must distinguish between public scan metrics and unique host counts. Censys metrics count distinct web properties defined by unique hostname and port combinations (for example, ebs.example.com:443 and ebs-qa.example.com:8000). Because single physical application instances often respond across multiple domains, ports, or load-balanced VIPs, the absolute count of distinct physical servers or corporate entities is lower than 2,246, though the exact host count is unconfirmed in public telemetry.

Regardless of specific host counts, internet accessibility for an ERP web tier creates severe enterprise risk. Oracle EBS and PeopleSoft platforms store regulatory-sensitive data stores covered by stringent compliance mandates:

• General Data Protection Regulation (GDPR): Processing employee and customer PII within compromised HR modules.
• Sarbanes-Oxley Act (SOX): Unauthorised manipulation of financial ledgers and procurement records directly impacts internal accounting controls.
• PCI-DSS: Storage or handling of payment processing workflows within integrated modules like Oracle Payments.

Incident Response and Threat-Hunting Playbook

Defenders must execute proactive threat-hunting routines across web server access logs, database audit tracks, and filesystem structures to identify potential exploitation attempts or persistent backdoors.

1. Web Server Access Log Inspection

Inspect Apache and Oracle HTTP Server (OHS) access logs for any HTTP POST or GET requests targeting the Thin Client Framework endpoint. Review logs for non-standard query parameters, abnormal user-agent strings, or high-volume request bursts.

Execute the following diagnostic search across the EBS HTTP server log directories:

# Diagnostic command: Parse OHS access logs for TCF servlet access
# Note: Adjust log file pathing to match local target installation standards
grep -E "POST|GET" /u01/oracle/visora/inst/apps/*/logs/ora/10.1.3/Apache/access_log* | grep -i "AppsTCFServer"

For PeopleSoft environments, audit the PSIGW and PSEMHUB web application logs for unexpected inbound HTTP requests containing loopback parameters or calls to administrative activities:

# Audit PeopleSoft Integration Gateway logs for localhost relay attempts
grep -i "validateClient" /u01/app/oracle/psft/pt8/webserv/*/applications/peoplesoft/PSIGW.war/WEB-INF/logs/*.log | grep -E "127\.0\.0\.1|localhost"

2. Database Query Context Auditing

Because CVE-2026-101767 grants query privileges under the APPS database schema, security analysts must review active and historical database execution records for suspicious system package invocations or shell-spawning routines.

Run the following safe diagnostic query against the Oracle Database monitoring views to check for recent suspicious SQL executions originating from application server IP addresses:

-- Query active and historical session SQL for suspicious APPS actions
SELECT 
    s.sid, 
    s.serial#, 
    s.username, 
    s.osuser, 
    s.machine, 
    s.program, 
    q.sql_text, 
    TO_CHAR(s.last_call_et) AS active_seconds
FROM v$session s
JOIN v$sql q ON s.sql_id = q.sql_id
WHERE s.username = 'APPS'
  AND (
       LOWER(q.sql_text) LIKE '%appstcfserver%'
    OR LOWER(q.sql_text) LIKE '%dbms_scheduler%'
    OR LOWER(q.sql_text) LIKE '%utl_file%'
    OR LOWER(q.sql_text) LIKE '%java/lang/runtime%'
  )
ORDER BY s.last_call_et ASC;

3. Filesystem Audit for Web Shell Persistence

To detect web shells deployed via the PeopleSoft PSEMHUB file path control flaw, perform file system integrity scans across all application server web root directories. Focus on newly created or modified .jsp, .jspx, .xml, or executable script files.

# Test in staging before executing against production environments
# Find web files modified in the web application path within the last 180 days
find /u01/app/oracle/psft/pt8/webserv/ -type f \( -name "*.jsp" -o -name "*.jspx" -o -name "*.war" \) -mtime -180 -ls

Inspect PSEMHUB configuration paths for unrecognized XML configuration files that could trigger deserialization routines during application service restarts:

# Search PSEMHUB configuration directories for anomalous XML files
find /u01/app/oracle/psft/pt8/psemhub/ -type f -name "*.xml" -mtime -180 -ls

Remediation and Hardening Strategy for Oracle Environments

Securing enterprise ERP instances against active CVE-2026-101767 and CVE-2026-35273 exploitation requires a combined program of immediate patching, temporary web tier access restrictions, and strict network segmentation.

1. Patch Application

Apply the Oracle October 2026 Critical Patch Update immediately to all Oracle EBS and PeopleSoft application tiers and backend databases. Verify that patch application scripts complete without errors and that compiled objects validate successfully.

2. Temporary Workarounds and Servlet Disablement

If applying the Oracle October 2026 CPU must be delayed due to maintenance window schedules or extended regression testing requirements, implement the temporary mitigations recommended by Horizon3.ai:

• URL Firewall Restricting: Remove the /OA_HTML/AppsTCFServer servlet mapping from the public URL firewall allowlist (e.g., inside Oracle HTTP Server or web application firewall rules) to block external HTTP routing to the Thin Client Framework.
• Web Tier Access Control: Restrict network access to the application tier strictly to authenticated, trusted internal networks or corporate VPN IP ranges.

Example OHS/Apache configuration stanza to block external access to the vulnerable EBS servlet:

# Block direct HTTP access to Thin Client Framework servlet
<Location /OA_HTML/AppsTCFServer>
    Order deny,allow
    Deny from all
</Location>

3. Post-Patch Credential and Session Sanitisation

Following patch application and filesystem cleanup, perform credential rotation across core administrative accounts:

1. Rotate database passwords for the APPS, SYSTEM, and SYS accounts.
2. Rotate administrative accounts in PeopleSoft (e.g., VP1 or domain administrative users).
3. Terminate active application sessions and invalidate saved session tokens across the application server web tier.

The following table summarizes the key vulnerabilities, affected components, structural impacts, and recommended mitigation actions:

Vulnerability Identifier	Affected Product & Version	Vulnerable Component	Attack Mechanics & Severity	Primary Mitigation Protocol
CVE-2026-101767	Oracle EBS 12.2.3 – 12.2.15	Application Object Library (/OA_HTML/AppsTCFServer)	Unauthenticated SQLi leading to host OS command execution (CVSS 9.8).	Apply October 2026 CPU; block servlet in URL firewall; restrict web tier access.
CVE-2026-35273 (Bug 1)	Oracle PeopleSoft Enterprise	PSIGW Gateway (validateClient)	SSRF logic bypass allowing loopback requests to internal administrative hubs.	Apply October 2026 CPU; disable unneeded external PSIGW endpoints.
CVE-2026-35273 (Bug 2)	Oracle PeopleSoft Enterprise	PSEMHUB (ExecuteProcessActivityCommand)	Path control flaw enabling arbitrary JSP web shell file writes.	Apply October 2026 CPU; conduct filesystem audit for dropped JSP backdoors.
CVE-2026-35273 (Bug 3)	Oracle PeopleSoft Enterprise	PSEMHUB XML Config Handler	Deserialization of untrusted XML configuration files on startup.	Apply October 2026 CPU; inspect environment configuration directories for staged XML files.

Key Takeaways for Enterprise Systems Engineering

The convergence of active probing against Oracle EBS and widespread web shell deployments across PeopleSoft highlights critical architecture requirements for platform engineers and security operations leads:

• Prioritise Emergency Patch Cycles for Core ERP Engines: Vulnerabilities in business-critical platforms like Oracle EBS and PeopleSoft represent high-value targets for ransomware syndicates and extortion actors. Patching schedules for core financial databases must support rapid emergency deployments when unauthenticated RCE flaws emerge.
• Enforce Zero-Trust Boundaries for Legacy Servlets: Administrative and legacy framework servlets (such as AppsTCFServer or PSEMHUB) should never be directly accessible from the public internet. Web application firewalls, URL allowlists, and strict network segmentation must insulate application servlets behind verified authentication boundaries.
• Establish Continuous Threat Hunting Beyond Vulnerability Scanning: Standard vulnerability scanners confirm whether code patches are present, but fail to detect web shells or malicious configuration files planted prior to patch deployment. Incident response protocols must integrate regular filesystem integrity verification and database session auditing into routine operations.

Frequently asked questions

What is the severity of Oracle EBS vulnerability CVE-2026-101767?

CVE-2026-101767 carries a CVSS v3.1 score of 9.8 (Critical). It is an unauthenticated vulnerability accessible over HTTP that allows remote attackers to execute arbitrary SQL commands with full APPS database schema privileges and pivot directly to operating system command execution on the host application server without user interaction.

Can an attacker exploit CVE-2026-101767 without authenticating to the database?

Yes. The vulnerability resides within the public-facing Thin Client Framework servlet (/OA_HTML/AppsTCFServer). An attacker does not require existing database credentials, valid application session cookies, or prior network authentication to send malicious HTTP requests that trigger the underlying SQL injection flaw.

Why is applying the Oracle October 2026 patch for PeopleSoft insufficient on previously targeted systems?

Applying the patch fixes the underlying SSRF, path traversal, and deserialization code flaws, preventing future exploitation. However, if attackers exploited the vulnerability prior to patch installation, they may have dropped JSP web shells or staged malicious XML configuration files on the server. These web shells remain fully functional and accessible post-patching unless manually identified and removed.

What temporary workarounds exist for Oracle EBS if patching must be delayed?

If immediate patching is not possible, organisations should remove the /OA_HTML/AppsTCFServer endpoint from public URL firewall allowlists to block inbound HTTP requests. Additionally, restrict web tier access strictly to trusted internal networks or corporate VPN boundaries, preventing direct public internet reachability.

How does the PeopleSoft attack chain achieve remote code execution across three vulnerabilities?

An attacker uses an SSRF in PSIGW (Bug 1) to bypass client validation and access the internal PSEMHUB service via loopback. They then exploit a file path control vulnerability in PSEMHUB (Bug 2) to write a web shell into a web directory. Alternatively, they place a malicious XML file (Bug 3) that triggers code execution when PSEMHUB deserializes configuration files during a service restart.

Related reading

• Analyzing Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains
• Oracle EBS CVE-2026-101767 and PeopleSoft Attack Chains

Sources and further reading

• Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) – Help Net Security (Help Net Security)
• Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble (The Register · Security)

This article was drafted with AI assistance from the publicly cited sources and passed automated checks for structure and sourcing. Verify critical details against the vendor advisories linked above before acting.