IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle E-Business Suite: Missing authentication in Application Object Library

CVE-2026-101767Critical 9.8Public exploit

← All vulnerabilities

Summary

Oracle E-Business Suite (EBS) releases 12.2.3 to 12.2.15 contain a critical flaw in the Core component of Application Object Library. An unauthenticated attacker with network access via HTTP can fully compromise the component, with high impact on confidentiality, integrity and availability (CVSS 9.8). No credentials or user interaction are required, so internet-exposed EBS web tiers are at particular risk. Exploitation attempts against decoy systems have been reported, but no confirmed customer compromises are known.

Affected

  • Oracle E-Business Suite 12.2.3 through 12.2.15, Application Object Library, Core component
  • Older releases: Unknown. Check with Oracle.

Fixed in

  • October 2026 Critical Patch Update (released 20 October 2026)
  • Patch details: My Oracle Support Note KA923 (login required, patch numbers not verified)
  • The full fix also requires the October 2026 CPU entries for the EBS database and Fusion Middleware layers

Workaround

  • No workaround replaces the patch.
  • If patching must be delayed, remove the TCF servlet path from the EBS URL firewall allowlist. Confirm the exact path in Oracle's advisory first, as sources differ on the name.
  • Review web-tier logs for unusual requests to the TCF servlet under /OA_HTML.

Exploitation

  • Oracle has not stated that the flaw has been exploited.
  • Unconfirmed: exploratory probes against decoy EBS systems were reported from 27 October 2026. No confirmed customer compromises are known.
  • CISA KEV: not listed as of 21 October 2026. Current status unknown.
  • Public proof-of-concept exploit code: none verified.

Our recommendation

  • Identify all EBS instances and their versions, and check whether the web tier is reachable from the internet.
  • Apply the October 2026 Critical Patch Update, including the database and middleware entries.
  • If patching is delayed, restrict access to the EBS web tier and apply the allowlist mitigation.
  • Monitor web and application logs for unusual TCF servlet requests and unexpected SQL activity under the APPS account.
  • Expect public exploit code to appear soon; prioritise patching now.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:18.

Original description (NVD)

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in takeover of Oracle Application Object Library. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed