Oracle closed more than 1,200 holes in its October Critical Patch Update. One of them is a CVSS 9.8 in the E-Business Suite, and the honeypots are already showing traffic aimed at it.
The flaw is CVE-2026-101767, in the Oracle Application Object Library. Oracle's own advisory language is blunt about the stakes: an attacker with HTTP access to a vulnerable instance needs no credentials to compromise it completely. Affected versions are 12.2.3 through 12.2.15.
Horizon3.ai's analysis traces the mechanism to a SQL injection in the Thin Client Framework servlet, and from there to injecting and executing code. That progression is what matters: SQL injection in an ERP backend is not a data-leak-only bug. It is a foothold on the system that holds the ledger.
DefusedCyber reported on X that its E-Business Suite honeypots have seen probing exploits against the CVE since Tuesday of this week. "Probing" is the operative word — these look like reconnaissance and capability testing rather than a mass campaign. There is, so far, no public evidence of the kind of coordinated data-theft operation the E-Business Suite has attracted before.
That history is exactly why the timeline is uncomfortable. In autumn 2025, the Cl0p ransomware group ran mass exploitation against an EBS vulnerability, exfiltrated data at scale, and then extorted victims over hundreds — possibly thousands — of compromised email accounts. At the end of June 2026, criminals exploited a different critical flaw in EBS Payments, again achieving full takeover of vulnerable instances. EBS is not an obscure target that attackers have to be taught to want. It is a rehearsed one.
The structural problem is that E-Business Suite is both business-critical and hard to patch. It sits under finance, HR, procurement and supply chain. It is frequently exposed to the internet through supplier portals and self-service modules. And large ERP upgrades move on an annual, sometimes multi-year, cadence, so security updates queue behind change-control boards. A patch day that ships well over a thousand fixes makes it easy for any single one to get lost.
The practical advice is the usual advice, which is also the correct advice. Apply the October CPU to any internet-reachable EBS instance now. If that cannot happen this week, take those instances off the public internet and put them behind a VPN or an application-layer gateway — the vulnerability requires network access, and removing it buys time. Then hunt: SQL injection attempts against Thin Client Framework endpoints, unusual outbound connections, and new accounts or scheduled jobs on database instances that should not have them.
The uncomfortable part is what a week of quiet honeypot probing implies. Weaponisation of an unauthenticated 9.8 in an ERP system is not an if. The window in which defenders hold the advantage is measured in days, and it opened when the patch shipped, not when the first victim called.
