// Oracle HealthHIGH
Threat actors have begun scanning the Internet for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution. Oracle released patches on October 20, 2026; threat intelligence firm Defused Cyber detected reconnaissance probes on October 27. Over 670 Internet-exposed EBS instances have been identified, primarily in the United States.
- Hackers now scanning systems for recently-patched Oracle flaw(opens in a new tab)
- Hackers Target Critical Oracle E-Business Suite RCE Flaw Days Af(opens in a new tab)
- Oracle celebrates end of Cybersecurity Awareness Month with quad(opens in a new tab)
- Oracle E-Business Suite Vulnerability: Probing Began Days After (opens in a new tab)
// Get alerts for Oracle Health