---
title: Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8, no login needed) is already drawing exploit attempts on Defused's decoys, a week after the October patch | ctxsec
url: https://ctxsec.com/items/oracle-ebs-cve-2026-101767-probing-defused-decoys
description: ""
status: "official CVE details (Oracle October 2026 CPU); exploitation attempts reported by Defused honeypots (Oct 27); no confirmed compromises reported"
published: 2026-10-28
---

> 

[← Cybersecurity News](/news) · [markdown](/items/oracle-ebs-cve-2026-101767-probing-defused-decoys.md)

official CVE details (Oracle October 2026 CPU); exploitation attempts reported by Defused honeypots (Oct 27); no confirmed compromises reported

2026-10-28

### Oracle E-Business Suite CVE-2026-101767 (CVSS 9.8, no login needed) is already drawing exploit attempts on Defused's decoys, a week after the October patch

Oracle's October 2026 Critical Patch Update lists **CVE-2026-101767** in the Oracle Application Object Library (Core) component of E-Business Suite: remotely exploitable over HTTP without authentication, CVSS 9.8, affecting **12.2.3 to 12.2.15**. Oracle credits Brandon Peterson, Jimi Sebree and Noah King of Horizon3.ai.

Honeypot company Defused says its EBS decoys recorded "exploratory exploits" on the morning of Oct 27, describing the bug as an unauthenticated SQL injection in EBS's Thin Client Framework servlet that chains to remote code execution. These are attempts against decoys; no victims have been reported, and the bug is not in CISA KEV.

**What to do:** apply the October CPU to EBS, starting with any instance reachable from the internet, and if you can't patch yet, keep EBS behind a VPN or restrict which source IPs can reach it. The same CPU also fixed [a CVSS 10.0 Workflow Notification Mailer bug in EBS](/items/oracle-cpu-oct-2026).

Sources: [Oracle Critical Patch Update, October 2026 (EBS risk matrix: CVE-2026-101767, CVSS 9.8)](https://www.oracle.com/security-alerts/cpuoct2026.html) · [Defused on X: EBS decoys recorded exploratory exploits against CVE-2026-101767 (Oct 27)](https://x.com/DefusedCyber/status/2115099999973364147)