Horizon3 Researchers Expose Unauthenticated SQLi in Oracle E-Business Suite Servlet

Oracle released security updates on October 20, 2026, to fix a critical unauthenticated SQL injection vulnerability in its E-Business Suite product. The flaw, tracked as CVE-2026-101767, carries a CVSS score of 9.8 and enables remote code execution, according to the National Vulnerability Database and Horizon3.ai.

Horizon3 researchers discovered that attackers can exploit the Thin Client Framework servlet to execute SQL commands as the APPS database user. This initial access allows them to escalate privileges and run operating system commands as the EBS application account, effectively taking control of the host system without any user interaction.

Technical Context and Exposure

The vulnerability resides in the Oracle Application Object Library, specifically within the Core component of E-Business Suite. The exploitable endpoint is the TCF servlet located at /OA_HTML/AppsTCFServer, which is implemented by the oracle.apps.fnd.tcf.SocketServer class. By default, this URL is permitted through the EBS firewall configuration, leaving many installations exposed to external attacks.

Exploitation requires only network access via HTTP or HTTPS to the vulnerable servlet. An attacker sends a crafted request that instantiates the Gantt data-server class, triggering backend database activity. This sequence allows the execution of SQL with APPS user privileges, leading to full system compromise if the attack chain is completed successfully.

Affected Systems and Data at Risk

The vulnerability impacts Oracle E-Business Suite versions 12.2.3 through 12.2.15, inclusive. Internet-facing web tiers present the highest risk, but internal deployments are also vulnerable if an attacker can reach the servlet from a compromised network segment or another accessible system within the organization.

Successful exploitation allows attackers to read or modify sensitive application data accessible to the APPS user. This data may include financial records, payroll information, human resources details, and procurement logs. Additionally, attackers can execute commands on the application host, governed by the permissions of the compromised EBS application account.

What should you do?

Oracle addressed this issue in its October 2026 Critical Patch Update. Administrators should apply the relevant patches immediately using the guidance in My Oracle Support Note KA923. Until patches are applied, organizations can mitigate risk by removing the /OA_HTML/AppsTCFServer endpoint from the EBS URL firewall allowlist and restricting access to trusted networks.

Monitoring for signs of compromise is also recommended. Indicators include unauthenticated POST requests to the TCF servlet, unexpected SQL reconnaissance activity, and the creation of files in the $APPLPTMP directory or the spawning of shell processes via the Concurrent Manager.

What to do and how to stay safe: Oracle

• Verify your Oracle E-Business Suite version falls within the affected range of 12.2.3 to 12.2.15 and check if the October 2026 patches have been applied.
• Configure firewalls to block external access to the /OA_HTML/AppsTCFServer endpoint to prevent unauthenticated exploitation attempts.
• Monitor database logs for unusual SQL activity originating from unauthenticated web requests, particularly those involving the APPS user.
• Watch for unexpected file creation in temporary directories like $APPLPTMP or new shell processes spawned by the EBS application account.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-101767?

It is a critical unauthenticated SQL injection vulnerability in Oracle E-Business Suite that allows remote code execution via the TCF servlet.

Which Oracle E-Business Suite versions are affected?

Versions 12.2.3 through 12.2.15 are affected by this vulnerability.

How can organizations mitigate the risk before patching?

Organizations should remove the /OA_HTML/AppsTCFServer endpoint from firewall allowlists and restrict access to the EBS web tier to trusted networks.