CVE-2026-101767

Work through these in order. A verified no at any step reduces your exposure. Patching is still the fix.

1. Are you running an affected version? Check the EBS release level with your DBA runbook. Anything from 12.2.3 to 12.2.15 is in scope.
2. Is the October 2026 CPU applied? Use My Oracle Support Note KA923 to find the patches required for your release, then confirm they're recorded as applied with the EBS patch wizard or ad_patch.is_patch_applied. If nothing is recorded, the fix isn't on.
3. Is the EBS web tier reachable from the internet? List every EBS web entry point (load balancers, reverse proxies, DMZ external nodes, iSupplier or iRecruitment portals) and test from outside your network whether https://<host>/OA_HTML/ responds. Horizon3 calls internet-facing web tiers the most direct exposure.
4. Is /OA_HTML/AppsTCFServer allowed through the URL firewall? On external (DMZ) web nodes, review the EBS URL firewall allowlist for AppsTCFServer. Horizon3 reports the default configuration permits it, so an untouched default should be treated as allowed.
5. Can it be reached internally? Horizon3 notes internal deployments are also at risk if an attacker can reach the servlet from another system or segment. Map which subnets, VPN pools, jump hosts and partner connections can reach the web tier on HTTP or HTTPS.
6. Does your proxy or WAF pass the path? Send a harmless request to /OA_HTML/AppsTCFServer from each network zone and record whether the edge blocks it or forwards it. Don't send exploit payloads to production.
7. What would an attacker inherit? SQL runs as the APPS database user, which has broad access to EBS data including financial, payroll, HR and procurement records. The chain runs OS commands as the EBS application account (often oracle or applmgr). Note what that account can read, write and reach, and whether it has sudo rights or stored credentials.

Horizon3 states these measures reduce exposure but don't replace patching. Test each control after you apply it rather than assuming it works.

• URL firewall. Remove /OA_HTML/AppsTCFServer (oracle.apps.fnd.tcf.SocketServer) from the EBS URL firewall allowlist, restart the web tier as your change process requires, and confirm the path now returns a block from every zone. Check first whether any business feature you run depends on the TCF servlet.
• WAF or virtual patch. Add a rule at the load balancer, reverse proxy or WAF that blocks requests to /OA_HTML/AppsTCFServer, and alert on requests that reference GanttDataServer.
• Restrict the web tier. Limit HTTP and HTTPS access to the EBS web tier to trusted networks only, including internal segments.
• EDR on the application tier. Make sure EDR covers the EBS application hosts and alerts when the EBS OS account or the Concurrent Manager starts a shell or other unexpected child process.
• IAM and least privilege. Reduce what the EBS OS account can do (no interactive login, no unneeded sudo, limited outbound network access), and review grants and directory objects available to APPS.

Horizon3's published indicators, plus the SIEM rules they suggest.

• Unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate oracle.apps.jtf.gantt.server.GanttDataServer, followed by backend database activity.
• SQL reconnaissance shortly after unauthenticated web requests, such as queries for database version, current user, or directory objects.
• Unexpected files in $APPLPTMP, and the oracle account spawning /bin/sh through the Concurrent Manager.
• SIEM alerts worth adding now. POSTs to /OA_HTML/AppsTCFServer, new files in $APPLPTMP, shell processes whose parent is the Concurrent Manager, and version, user or directory queries from the web tier shortly after unauthenticated requests.

Am I exposed to CVE-2026-101767?

You're likely exposed if you run Oracle E-Business Suite 12.2.3 through 12.2.15 without the October 2026 Critical Patch Update and an untrusted network can reach /OA_HTML/AppsTCFServer on your EBS web tier. Internet-facing web tiers are the most direct exposure, but internal access paths count too.

Is there a patch for CVE-2026-101767?

Yes. Oracle fixed it in the October 2026 Critical Patch Update, released October 20, 2026. Use My Oracle Support Note KA923 to find the patches required for your EBS release. The same update fixes other unauthenticated EBS issues, including CVE-2026-101809 in Workflow Notification Mailer (CVSS 10.0), so applying the full EBS patch set covers both.

How do I mitigate CVE-2026-101767 without patching?

Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, block the path at your WAF or proxy, restrict the web tier to trusted networks, and monitor the application host and database for Horizon3's indicators. Test each control, and patch as soon as you can, because these steps reduce exposure but don't replace the fix.

Is CVE-2026-101767 being exploited?

Exploitation is reported but not confirmed. On October 27, 2026, Defused reported exploratory exploit attempts against its EBS honeypots, and a public GitHub proof-of-concept repository appeared on October 26, 2026 (not reviewed). As of October 27, 2026, CVE-2026-101767 is not on CISA's KEV catalog. CISA's SSVC entry on NVD (Oct 21) recorded exploitation as none, automatable as yes, and technical impact as total.

Oct 27, 2026. First published. Exploitation reported by Defused, not on CISA KEV.

• Oracle Critical Patch Update Advisory, October 2026 (E-Business Suite risk matrix; Rev 2, Oct 26, 2026)
• Horizon3.ai: CVE-2026-101767, Oracle EBS TCF SQL Injection and Remote Code Execution
• NIST NVD: CVE-2026-101767
• CISA Known Exploited Vulnerabilities Catalog (checked catalog version 2026.10.26)
• Defused on X, exploratory exploit attempts against EBS decoys, Oct 27, 2026
• GitHub: seck19/CVE-2026-101767-POC (public PoC repository, not reviewed)