Horizon3.ai

Threat Actors Exploit Critical CVE-2026-101767 RCE Flaw in Oracle E-Business Suite

Threat intelligence firm Defused detected active exploitation attempts against CVE-2026-101767 targeting Oracle E-Business Suite honeypots on October 27, 2026. The vulnerability carries a CVSS 3.1 score of 9.8, requires no authentication, and resides in the Thin Client Framework servlet within the Application Object Library component. Oracle released a fix seven days earlier in its October 2026 Critical Patch Update, covering versions 12.2.3 through 12.2.15. Successful exploitation grants SQL execution under the privileged APPS database account, enabling lateral movement to operating system commands and access to financial, payroll, and procurement records. Horizon3.ai privately reported the issue in July 2026, and prior similar flaws in the same product were leveraged by the Cl0p ransomware group. Immediate mitigation includes applying the quarterly patch or restricting access to the GanttDataServer servlet via URL firewall rules.