Scanning Begins Against Critical Oracle E-Business Suite Authentication Flaw

Attackers have begun probing internet-facing Oracle E-Business Suite (EBS) systems for a newly disclosed critical vulnerability, according to a report by SecurityWeek international correspondent Ionut Arghire. The flaw, tracked as CVE-2026-101767, sits in the Oracle Application Object Library, a core part of the business software suite. It carries a CVSS score of 9.8 out of 10. According to vulnerability data drawn from NVD and CISA, an attacker with no username or password can exploit it over the network to take control of the affected component. The report does not give an exact date for when the probing started. Its headline describes the vulnerability as "fresh," which suggests attackers moved quickly after disclosure.

What happened

Oracle E-Business Suite is a large package of enterprise applications. Organisations use it to run finance, procurement, supply chain, human resources and other back-office work. Because these systems often hold sensitive financial and personnel data, they are attractive targets.

The sequence of events, as far as the available material shows, is short:

• A vulnerability in the Core component of the Oracle Application Object Library was assigned the identifier CVE-2026-101767 and rated critical.
• Vulnerability records describe it as easy to exploit, remotely reachable over HTTP, and usable without any login.
• SecurityWeek then reported that hackers had started probing for the flaw.

"Probing" usually means scanning the internet for systems that may be vulnerable, or sending test requests to see whether a target responds in a way that suggests it is exposed. It is often an early stage before full-scale attacks. However, probing alone does not prove that any organisation has been breached.

Who is affected

According to the verified CVE description, the vulnerable product is the Oracle Application Object Library, part of Oracle E-Business Suite. The affected supported versions are 12.2.3 through 12.2.15.

There is one inconsistency to note. The structured "affected products" field in the CVE database is listed as "Unknown," while the written description names the 12.2.3–12.2.15 range. This kind of gap is common in the early days after disclosure, when databases are still being filled in. Administrators should treat the stated version range as the working guide and confirm it against Oracle's own advisory.

The sources do not say which industries, countries or regions are being targeted, or how many EBS installations are reachable from the internet. Any organisation running an affected version of EBS, particularly one whose web interface is reachable from outside the corporate network, should assume it may be of interest to attackers.

How it works

The vulnerability record links the flaw to two weakness categories from the Common Weakness Enumeration (CWE), a standard catalogue of software mistakes:

• CWE-287, Improper Authentication. The software does not properly verify that a user is who they claim to be.
• CWE-306, Missing Authentication for Critical Function. A sensitive function can be reached without any login check at all.

In plain terms, part of the Application Object Library apparently lets someone carry out actions that should be restricted to logged-in, authorised users, without asking for proof of identity. The Application Object Library is a foundational layer of EBS that underpins features such as user management and security across the suite. A weakness at this level is therefore more serious than a bug in a single add-on module.

The record also says the attack works over HTTP, the standard protocol used by web browsers and web applications. An attacker does not need physical access, a stolen password, or a victim to click a link. Network access to the EBS web interface is enough. Oracle's description says a successful attack can result in "takeover of Oracle Application Object Library."

The sources do not publish technical specifics such as the exact endpoint or request involved. ITVedas will not speculate about them.

How serious is it?

On paper, it is about as serious as vulnerabilities get. The CVSS 3.1 base score is 9.8, rated Critical. CVSS, the Common Vulnerability Scoring System, is a 0–10 scale used across the industry to rank how dangerous a flaw is. A 9.8 typically reflects a combination of factors that all favour the attacker:

• It can be exploited remotely over a network.
• It is easy to exploit, with no special conditions required.
• No login or user interaction is needed.
• The impact on confidentiality, integrity and availability is high. An attacker could read data, change it, and disrupt the system.

On whether the flaw is being exploited in the wild, the picture is mixed. As of our check, CISA's Known Exploited Vulnerabilities (KEV) catalogue does not list CVE-2026-101767. The KEV catalogue is the US government's list of flaws with confirmed real-world exploitation. Meanwhile, SecurityWeek reports that hackers have started probing for the bug.

These two points do not necessarily contradict each other. Scanning and probing often come before confirmed, successful attacks, and KEV listings require evidence of actual exploitation. Still, readers should understand that, based on the available material, active scanning has been reported, but confirmed compromises have not been publicly verified.

What to do now

The source material does not name a specific patch release or fixed version number. Administrators should consult Oracle's official security advisory for CVE-2026-101767 to identify the correct fix for their release.

For EBS administrators and security teams:

• Inventory every Oracle E-Business Suite instance and confirm its version. Anything from 12.2.3 to 12.2.15 should be treated as affected.
• Locate Oracle's fix for CVE-2026-101767 and apply it as an emergency change, not on the normal maintenance schedule.
• Until patched, restrict network access to EBS web interfaces. Remove direct internet exposure where possible, and require VPN or allow-listed IP addresses for remote users.
• Review web server and application logs for unusual unauthenticated requests to EBS, especially traffic arriving since the flaw was disclosed.
• Check for signs of compromise, such as unexpected new accounts, privilege changes, or configuration modifications within the Application Object Library.
• Make sure EBS logs are sent to your central monitoring system so suspicious activity triggers alerts.
• Watch the CISA KEV catalogue and Oracle's advisories for updates. A KEV listing would signal confirmed exploitation.

For everyday users and staff:

• You do not need to patch anything yourself. This is a server-side issue that your IT team must fix.
• Report anything odd in your organisation's finance, HR or procurement systems, such as unexpected changes to your profile, payment details or approvals.
• Be alert to phishing emails that refer to "Oracle," "EBS" or "urgent system updates." Attackers often exploit news about vulnerabilities to trick users.

What we still don't know

• When exactly the probing began, and how widespread it is.
• Who is behind the scanning: criminal groups, state-backed actors, researchers, or a mix.
• Whether any organisation has been successfully breached through this flaw. CISA has not added it to KEV as of our check.
• The specific patch details, including which Oracle update addresses the flaw. The source material does not name them.
• Whether unsupported, older EBS versions are also vulnerable. The description covers only "supported versions" 12.2.3–12.2.15.
• Who discovered the vulnerability and how it was reported to Oracle.
• Which sectors or regions, if any, are being singled out.

ITVedas analysis: Oracle EBS holds the financial and personnel records that extortion groups value most. An unauthenticated, network-reachable flaw in its core library leaves little room for delay. Organisations should not wait for a KEV listing before acting. By the time exploitation is confirmed, the most exposed systems may already have been compromised.