Security researchers have detected the first probing attempts against a newly patched Oracle E-Business Suite weakness, only a week after the fix was released. Threat intelligence firm Defused Cyber said its decoy Oracle systems recorded exploratory attacks on 27 October, a development reported on 28 October. The timing matters because the window between a patch and widespread scanning is often short, and systems left unpatched after a public fix become easier targets once attackers can study what changed.

A flaw that needs no login

The weakness, tracked as CVE-2026-101767, carries a CVSS score of 9.8 and affects Oracle E-Business Suite versions 12.2.3 to 12.2.15. It is an unauthenticated SQL injection problem in the Thin Client Framework servlet, reached at /OA_HTML/AppsTCFServer. Researchers who found the flaw say a crafted request can run database commands with the privileges of the APPS database user and then lead to operating-system commands under the E-Business Suite application account, giving an attacker deep control over a vulnerable system.

Patch first, then check the logs

Oracle fixed the flaw in its Critical Patch Update of 20 October 2026, so the immediate step for administrators is to apply that update, starting with internet-facing systems. Where patching cannot happen at once, researchers advise removing the affected servlet from the URL firewall allowlist and limiting web access to trusted networks. Teams should also search logs for unauthenticated requests to that servlet and for unusual database activity afterwards. The reports so far describe probing of decoy systems, not confirmed breaches of customer systems, and the flaw was not listed in CISA's exploited-vulnerabilities catalogue as of 27 October.

Sources: The Hacker News, Brandefense.