{"id":"CVE-2026-101767","kind":"vulnerability","aliases":["CVE-2026-101767"],"related":[],"title":"Oracle E-Business Suite: unauthenticated HTTP flaw lets attackers take over Application Object Library","description":"Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Unauthenticated SQL injection in the Thin Client Framework servlet (/OA_HTML/AppsTCFServer) of Oracle E-Business Suite Application Object Library (Core), 12.2.3-12.2.15. It runs SQL as the APPS database user and chains to OS command execution as the EBS application account. CVSS 9.8. Reported by Horizon3.ai; fixed in the October 2026 CPU.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle E-Business Suite Application Object Library","fixed":["Oct 2026 CPU (Patch 40022426:12.2.0, per Rapid7)"],"affected":">= 12.2.3, <= 12.2.15","ecosystem":"vendor"}],"ecosystems":[],"tags":["enterprise-erp","oracle-ebs","package","rce","self-hosted","sql-injection","unauthenticated"],"not_affected_if":["versions-outside-12.2.3-12.2.15","web-tier-not-reachable"],"how_to_check":"Confirm your EBS release is 12.2.3-12.2.15 and whether the Oct 2026 CPU patch for AOL is applied (see MOS Note KA923). Check whether /OA_HTML/AppsTCFServer is allowed in the EBS URL firewall and reachable from untrusted networks. Look for unauthenticated POSTs to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh via Concurrent Manager.","fix":"Apply the Oracle October 2026 Critical Patch Update for EBS (Rapid7 lists Patch 40022426:12.2.0; confirm against MOS Note KA923). Until patched: remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict the web tier to trusted networks.","status":"open","published_at":"2026-10-20T22:18:32+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","triaged_at":"2026-10-23T22:38:39+00:00","updated_at":"2026-10-23T23:07:13+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:38:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Oracle E-Business Suite: unauthenticated HTTP flaw lets attackers take over Application Object Library","impact":"high","summary":"Oracle E-Business Suite's Application Object Library component (Core) has a flaw in versions 12.2.3 through 12.2.15 that a remote attacker can trigger over HTTP without logging in. Successful exploitation gives the attacker takeover of the component, with high confidentiality, integrity and availability impact.","category":"package","who_cares":["oracle-ebs","enterprise-erp","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the component and reads or changes ERP data","analyst_note":"Find Oracle's Critical Patch Update advisory and the patch number for AOL Core 12.2.x, plus any mitigation steps, at https://nvd.nist.gov/vuln/detail/CVE-2026-101767 and Oracle's security alerts page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-outside-12.2.3-12.2.15"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000523,"input_tokens":3059,"output_tokens":435,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory and the patch number for AOL Core 12.2.x, plus any mitigation steps, at https://nvd.nist.gov/vuln/detail/CVE-2026-101767 and Oracle's security alerts page.","search":"'-101767':18A,21A '-2026':17A,20A '/av':166C '/oa_html/appstcfserver':54B '12.2.15':66B,120C '12.2.3':65B,119C '2026':95B '3.1':153C,165C '9.8':87B,156C 'access':129C 'account':85B 'affect':117C 'allow':124C 'app':72B 'applic':13A,61B,84B,101C,135C,149C 'application':27A 'attack':10A,126C,139C 'avail':160C 'base':154C 'busi':4A,59B,109C 'business':25A 'chain':76B 'client':51B 'command':79B 'compon':111C 'compromis':133C 'confidenti':157C 'core':64B,112C 'cpu':96B 'cve':16A,19A 'cvss':86B,152C,162C,164C 'databas':73B 'e':3A,24A,58B,108C 'e-busi':2A,57B,107C 'e-business':23A 'easili':121C 'eb':35B,83B 'enterpris':31B 'enterprise-erp':30B 'erp':32B 'execut':80B 'exploit':122C 'fix':91B 'flaw':8A 'framework':52B 'h':174C 'h/a':173C 'h/i':172C 'horizon3.ai':90B 'host':40B 'http':7A,131C 'impact':161C 'inject':43B,47B 'integr':158C 'l/pr':168C 'let':9A 'librari':15A,63B,103C,137C,151C 'library':29A 'n/ac':167C 'n/s':170C 'n/ui':169C 'network':128C 'object':14A,28A,62B,102C,136C,150C 'octob':94B 'oracl':1A,34B,56B,100C,106C,134C,148C 'oracle':22A 'oracle-eb':33B 'os':78B 'packag':36B 'product':104C 'rce':37B 'report':88B 'result':144C 'run':68B 'score':155C 'self':39B 'self-host':38B 'servlet':53B 'sql':42B,46B,69B 'sql-inject':41B 'success':138C 'suit':5A,60B,110C 'suite':26A 'support':113C 'take':11A 'takeov':146C 'thin':50B 'u/c':171C 'unauthent':6A,44B,45B,125C 'user':74B 'vector':163C 'version':114C 'via':130C 'vulner':97C,123C,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101767","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101767","severity":null,"published_at":"2026-10-20T22:18:32+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:23+00:00","fetched_at":"2026-10-23T22:28:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-101767:369","url":null,"severity":null,"published_at":"2026-10-23T23:07:13+00:00","modified_at":"2026-10-23T23:07:13+00:00","first_seen_at":"2026-10-23T23:07:13+00:00","fetched_at":"2026-10-23T23:07:13+00:00","note":"Oracle Oct 2026 CPU (Oct 20) fixes it; Horizon3 (reporter) describes unauth SQLi in TCF servlet /OA_HTML/AppsTCFServer chaining to RCE, gives mitigation and IOCs. Patch number 40022426:12.2.0 comes from Rapid7 only; I did not read Oracle's EBS patch page or MOS Note KA923. No exploitation reported and not in KEV as of Oct 21-23; Horizon3 says chain is public but I found no PoC link."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1786,"url":"https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/","title":"Horizon3: Oracle EBS TCF SQL Injection and RCE (CVE-2026-101767)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1787,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-101767/","title":"Rapid7 DB: CVE-2026-101767 (Patch 40022426:12.2.0)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1789,"url":"https://x.com/Horizon3Attack/status/2112651247362658611","title":null,"kind":"post","source":"analyst","text":"@Horizon3Attack (Horizon3 Attack Team, 13266 followers) · likes 175 reposts 47\nWe discovered CVE-2026-101767, an unauthenticated SQL injection in #Oracle E-Business Suite that chains to remote code execution. Fixed in Oracle's October CPU. Technical details to come later. Indicators of Compromise: Unauthenticated POST requests to /OA_HTML/AppsTCFServer","published_at":"2026-10-20T00:00:00+00:00","relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}