- Horizon3.ai reports CVE-2026-101767, an unauthenticated SQL injection in Oracle E-Business Suite 12.2.3 through 12.2.15 that can be chained to run commands on the application host.
- The vulnerable servlet is allowed through Oracle's default URL firewall configuration, so a firewall that looks configured may not block it.
- Oracle released patches on October 20, 2026. Teams should patch, remove the servlet from the allowlist, restrict access, and check for the signs Horizon3 lists.
The firewall rule was the open door
It is easy to assume the URL firewall in front of business software does its job. The thinking is simple. If a page is not on the allowlist, outsiders cannot reach it. Horizon3.ai's report on CVE-2026-101767 exposes the flaw in that thinking. The vulnerable page is already permitted by default.
Horizon3's attack research team found an unauthenticated SQL injection in Oracle E-Business Suite (EBS). SQL injection means an attacker sends database commands disguised as ordinary input. Horizon3 says the flaw can be chained to run commands on the underlying server. It gives the flaw a 9.8 score on the CVSS 3.1 scale and labels it Critical.
How the flaw works
The target is a servlet at /OA_HTML/AppsTCFServer. A servlet is a small program on a web server that answers requests. This one is built on oracle.apps.fnd.tcf.SocketServer, part of the Thin Client Framework. Oracle tracks the bug inside Application Object Library, in a part called Core.
Horizon3 says the attacker needs only a network route to the servlet over HTTP or HTTPS. No login is needed. No one has to click anything. The weakness is classed as CWE-306, missing authentication for a critical function.
A crafted request runs SQL with the rights of the APPS database user. The chain then runs commands with the rights of the EBS application account. Horizon3 says the records at stake could include finance, payroll, HR and purchasing data, depending on how the system is set up. What an attacker can do on the server depends on that account's permissions.
Who is exposed
Every release from 12.2.3 to 12.2.15 is affected. Horizon3 says web servers facing the internet carry the most direct exposure.
Internal systems are not off the hook. Horizon3 warns that an attacker who has already taken over one machine, or who sits on a neighbouring reachable network, could still send requests to the servlet.
That matters for finance and HR leaders. A system with no public address is not safe on that basis alone. If one compromised machine can reach the servlet, it becomes a route in.
Three months between report and patch
Horizon3 says it told Oracle about the flaw on July 24, 2026. Oracle's fixes came on October 20, inside its October 2026 Critical Patch Update. That is about 88 days.
Horizon3's timeline says its Rapid Response customer assets were assessed and notified after the July 24 disclosure. The source does not say who else knew about the flaw, or when. It also does not report any exploitation in the wild.
This is the lesson here: a setting that ships as the default is a decision made for you. Teams that never changed the EBS URL firewall list inherited an exposure they did not choose.
What to ask your team this week
Horizon3 points to My Oracle Support Note KA923 for the right patches for each installation. Until they are installed, it suggests three interim steps. These cut exposure but do not replace patching.
First, take /OA_HTML/AppsTCFServer off the URL firewall allowlist. Second, let only trusted networks reach the EBS web tier. Third, keep a close eye on the application server and the database, and look for evidence that someone has already got in.
Horizon3 lists what that evidence looks like. One sign is an anonymous POST request to the servlet that calls the Gantt data-server class, oracle.apps.jtf.gantt.server.GanttDataServer, with database activity following it. Another is early probing of the database, such as queries for its version, current user and directory objects.
On the server, check the $APPLPTMP folder for files nobody can explain. Also check whether the oracle account started a shell (/bin/sh) through the Concurrent Manager.
Ask three questions. Which of our EBS instances run 12.2.3 to 12.2.15? Can any untrusted network reach the servlet today? Who owns the check for the signs above, and has it run?
One caveat: Horizon3 also sells a testing product, NodeZero, and recommends its test to verify exposure. The patch status and the log checks do not depend on any vendor tool.
A firewall list only protects you if you know what is on it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Horizon3.ai.
