CVE-2026-101767
CRITICAL · 9.8 EPSS 0.6%Real vuln, patches live, probing observed; no confirmed in-the-wild compromise; not KEV-listed yet.
What: Unauthenticated remote code execution in Oracle E-Business Suite Application Object Library (versions 12.2.3–12.2.15) via HTTP. CVSS 9.8 CRITICAL; EPSS 0.49%.
Why it matters: Oracle patched October 20, 2026. Censys identified 2,246 exposed instances. Defused Cyber reported exploratory probe activity against the patched flaw, but in-the-wild exploitation is unconfirmed. CVE is not yet KEV-listed. Chatter conflates this with CVE-2026-101809 (CVSS 10.0 Workflow flaw), creating noise.
Where it's seen: SANS Stormcast coverage, security vendor rapid-response alerts, defender queries on exposure scope, honeypot/decoy signals of probing (not confirmed active exploitation).
RISK: HIGH — Trivially exploitable, unauthenticated, critical impact; 2,246+ exposed assets; patched but adoption lag likely.
Description
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High