---
id: "CVE-2026-101767"
kind: "vulnerability"
aliases: ["CVE-2026-101767"]
title: "Oracle E-Business Suite: unauthenticated HTTP flaw lets attackers take over Application Object Library"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Oracle E-Business Suite Application Object Library", "fixed": ["Oct 2026 CPU (Patch 40022426:12.2.0, per Rapid7)"], "affected": ">= 12.2.3, <= 12.2.15", "ecosystem": "vendor"}]
ecosystems: []
tags: ["enterprise-erp", "oracle-ebs", "package", "rce", "self-hosted", "sql-injection", "unauthenticated"]
not_affected_if: ["versions-outside-12.2.3-12.2.15", "web-tier-not-reachable"]
published_at: "2026-10-20T22:18:32+00:00"
first_seen_at: "2026-10-23T21:57:23+00:00"
updated_at: "2026-10-23T23:07:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101767", "first_seen_at": "2026-10-23T21:57:23+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:07:13+00:00"}]
---

# Oracle E-Business Suite: unauthenticated HTTP flaw lets attackers take over Application Object Library

Unauthenticated SQL injection in the Thin Client Framework servlet (/OA_HTML/AppsTCFServer) of Oracle E-Business Suite Application Object Library (Core), 12.2.3-12.2.15. It runs SQL as the APPS database user and chains to OS command execution as the EBS application account. CVSS 9.8. Reported by Horizon3.ai; fixed in the October 2026 CPU.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle E-Business Suite Application Object Library affected >= 12.2.3, <= 12.2.15 fixed Oct 2026 CPU (Patch 40022426:12.2.0, per Rapid7)

## How to check

Confirm your EBS release is 12.2.3-12.2.15 and whether the Oct 2026 CPU patch for AOL is applied (see MOS Note KA923). Check whether /OA_HTML/AppsTCFServer is allowed in the EBS URL firewall and reachable from untrusted networks. Look for unauthenticated POSTs to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh via Concurrent Manager.

## Fix

Apply the Oracle October 2026 Critical Patch Update for EBS (Rapid7 lists Patch 40022426:12.2.0; confirm against MOS Note KA923). Until patched: remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist and restrict the web tier to trusted networks.

## Timeline

- 2026-10-23T21:57:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101767
- 2026-10-23T23:07:13+00:00 analyst — Oracle Oct 2026 CPU (Oct 20) fixes it; Horizon3 (reporter) describes unauth SQLi in TCF servlet /OA_HTML/AppsTCFServer chaining to RCE, gives mitigation and IOCs. Patch number 40022426:12.2.0 comes from Rapid7 only; I did not read Oracle's EBS patch page or MOS Note KA923. No exploitation reported and not in KEV as of Oct 21-23; Horizon3 says chain is public but I found no PoC link.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Horizon3: Oracle EBS TCF SQL Injection and RCE (CVE-2026-101767) https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/
- [discussion] https://x.com/Horizon3Attack/status/2112651247362658611 https://x.com/Horizon3Attack/status/2112651247362658611
- [fix] Rapid7 DB: CVE-2026-101767 (Patch 40022426:12.2.0) https://www.rapid7.com/db/vulnerabilities/cve-2026-101767/

## From the sources

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core).  Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library.  Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_