Cybercriminals have begun scanning the internet for systems vulnerable to a recently disclosed critical flaw in Oracle E-Business Suite. The vulnerability, identified as CVE-2026-101767, exists in the Application Object Library and allows unauthenticated attackers with HTTP network access to compromise affected systems with minimal effort. Oracle released security patches on October 20 and urged customers to apply updates immediately, warning that some organizations have suffered breaches after failing to install available patches.
Threat intelligence company Defused detected threat actors already probing for vulnerable systems on October 27, identifying exploratory exploitation attempts against the flaw. Internet threat tracker Shadowserver has identified over 670 exposed Oracle EBS instances online, predominantly located in the United States. Oracle vulnerabilities are frequently targeted by criminal groups seeking to breach major enterprises, government agencies, and healthcare organizations. The U.S. Cybersecurity and Infrastructure Security Agency has added 46 Oracle security bugs to its list of actively exploited vulnerabilities since November 2021, with 13 being used in ransomware attacks.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
