Threat actors have begun probing for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), tracked as CVE-2026-101767.
The vulnerability or weakness
The flaw, an unauthenticated SQL injection in the Application Object Library product, has a CVSS score of 9.8 and is not included in CISA's Known Exploited Vulnerabilities list.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-101767 | 9.8 | CRITICAL | No | - |
| CVE-2026-46817 | 9.8 | CRITICAL | Yes, added 2026-07-15 | 2026-07-18 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Successful exploitation could allow attackers to achieve remote code execution, potentially disrupting operations and compromising sensitive data.
Industries affected
The vulnerability affects a wide range of industries, including consumer goods, energy, engineering, entertainment, finance, and manufacturing.
Users affected
Organizations using Oracle E-Business Suite are at risk, and their customers may be impacted if sensitive data is compromised.
Build these skills
Sources
- Hackers Start Probing Fresh Oracle EBS Vulnerability (SecurityWeek)
