Defused says its Oracle E-Business Suite decoys recorded exploratory exploits on October 27 against CVE-2026-101767. Oracle had released the corresponding fix in its October 20 Critical Patch Update, its quarterly collection of security patches.

Sergiu Gatlan’s October 28 report brings those observations together with Oracle’s advisory. The immediate task for EBS operators is to establish actual patch coverage and limit access to unpatched application services.

Evidence status: vendor-confirmed vulnerability and researcher-reported exploit attempts against decoys. The reviewed sources provide no verified production-victim count for this CVE.

HTTP access is the important prerequisite

Oracle’s October risk matrix and CVE record identify the affected product as Oracle Application Object Library, a core EBS component. They list 12.2.3 through 12.2.15 as affected supported versions.

Oracle describes an attacker with HTTP network access, without authentication or user interaction, taking over the component. Its assessment rates attack complexity low. An application login therefore does not establish protection when an attacker can reach the vulnerable HTTP path.

That is a supported-version range, not a finding that older, unsupported installations are safe. Likewise, the EBS release label alone does not reveal which security patches an installation contains.

Defused describes the mechanism as SQL injection in the Thin Client Framework servlet, a server-side request handler, chained to code execution. That more detailed description is the researcher’s account. Oracle’s public record confirms the takeover impact without documenting that full chain.

Decoy observations are not a victim count

Defused’s October 27 statement says its decoys recorded “exploratory exploits” that morning. Decoys are systems set up to observe attackers. The statement supports a report of attempts against this specific flaw, not a measured population of compromised businesses.

BleepingComputer also cites Shadowserver’s inventory of more than 670 internet-exposed EBS instances. It explicitly says that inventory does not distinguish patched systems or honeypots. It cannot be relabeled as 670 vulnerable or breached installations.

Oracle’s advisory contains a general warning that attackers have successfully exploited unpatched Oracle products. That standard warning does not independently confirm successful production exploitation of CVE-2026-101767. Earlier EBS and PeopleSoft campaigns cited in the reporting involve different vulnerabilities.

Verify the patch, including EBS dependencies

Use Oracle’s October 2026 EBS patch instructions for the deployed environment. The public matrix refers administrators to My Oracle Support Note KA923 for the Release 12 patch guidance. It does not name a single universal replacement EBS version or patch identifier for this CVE.

The same section warns that EBS also includes Oracle Database and Fusion Middleware components with separate security updates. Those component fixes are not all repeated in the EBS risk matrix. Treat application and dependency coverage as separate checks.

For an affected deployment:

  • Confirm the applicable October fix is installed, using the vendor’s patch records and environment-specific instructions. Retain evidence for this exact CVE.
  • Limit untrusted network access to unpatched EBS HTTP services while applying the repair. Access restrictions reduce reachability; they do not replace the patch.
  • Review suspicious access as an incident question, preserving relevant logs and escalating credible signs of intrusion. Patching closes a flaw but cannot establish whether earlier access occurred.

Caveat: Defused sells threat-intelligence services and supplies the decoy observation. The reviewed public evidence leaves successful production exploitation and the number of affected organizations unresolved.