Threat reportVulnerabilityTL-2026-3988
CVE-2026-101767: Oracle E-Business Suite TCF Unauthenticated SQL Injection and Remote Code Execution
CVE-2026-101767 (TL-2026-3988) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-20. It has no confirmed attribution, affects Oracle Oracle E-Business Suite (Application Object Library, Core, references 1 CVE (CVE-2026-101767), maps to 6 MITRE ATT&CK techniques (T1033, T1059, T1059.004), and is covered by 9 detection rules and 7 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3988
- Threat ID
- TL-2026-3988
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, government administration, health, manufacturing, retail, education
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How CVE-2026-101767 works
Horizon3.ai reports an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet of the Oracle Application Object Library (Core) component of Oracle E-Business Suite 12.2.3 through 12.2.15, chainable to operating-system command execution. Oracle fixed it in the October 2026 Critical Patch Update; no in-the-wild exploitation or public PoC is reported in the source.
CVE-2026-101767 affects the Oracle Application Object Library (Core) component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15 inclusive. The vulnerable code is reachable through the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer (implementation class oracle.apps.fnd.tcf.SocketServer), which is permitted through the default EBS URL firewall configuration. An unauthenticated attacker with HTTP/HTTPS network access can send requests that result in SQL injection executing as the APPS database user (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8; CWE-89 and CWE-306).
Per Horizon3.ai, the SQL injection can be chained to remote code execution, giving command execution at the operating-system level with the privileges of the EBS application account. Data reachable through the APPS user includes financial, payroll, HR and procurement records. Horizon3.ai's indicators of compromise describe unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class oracle.apps.jtf.gantt.server.GanttDataServer, followed by SQL reconnaissance (database version, current user, directory objects), unexpected files in the $APPLPTMP directory, and the Oracle account spawning /bin/sh via the Concurrent Manager.
Horizon3.ai disclosed the issue to Oracle on 2026-07-24 and notified its Rapid Response customers. Oracle shipped the fix in the October 2026 Critical Patch Update on 2026-10-20 (My Oracle Support Note KA923). The source provides no threat-actor attribution, no confirmed in-the-wild exploitation and no public PoC. Earlier Gantt Server and TCF Server SQL injection issues in EBS (for example JVNDB-2017-008750, CVE-2019-2633/CVE-2019-2638) show this attack surface has been targeted before, but are separate vulnerabilities. At the time of research the NVD API returned no record for this CVE ID. Defenders who cannot patch immediately should remove /OA_HTML/AppsTCFServer from the URL firewall allowlist and restrict EBS web-tier access to trusted networks.
MITRE ATT&CK techniques used in TL-2026-3988
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1190 Exploit Public-Facing Application
Collection
Affected products and versions in CVE-2026-101767
- Oracle — Oracle E-Business Suite (Application Object Library, Core component)
Vulnerable versions: 12.2.3; 12.2.4; 12.2.5; 12.2.6; 12.2.7; 12.2.8; 12.2.9; 12.2.10; 12.2.11; 12.2.12
Fixed in: With Oracle October 2026 Critical Patch Update applied
Remediation for CVE-2026-101767
Patches
- Oracle Critical Patch Update October 2026 (2026-10-20), My Oracle Support Note KA923
Immediate actions
- Apply the Oracle October 2026 Critical Patch Update (My Oracle Support Note KA923) to all EBS 12.2.3-12.2.15 environments
- Remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist until patched
- Restrict EBS web-tier access to trusted networks only
- Hunt for unauthenticated POSTs to /OA_HTML/AppsTCFServer referencing oracle.apps.jtf.gantt.server.GanttDataServer
Workarounds
- Remove /OA_HTML/AppsTCFServer from the URL firewall allowlist
- Limit EBS web-tier exposure to trusted networks
- Monitor the application host and database for signs of compromise
Longer-term hardening
- Keep EBS URL firewall allowlists minimal and review them after each CPU
- Monitor application and database hosts for unexpected files in $APPLPTMP
- Alert on the Oracle application account spawning /bin/sh via Concurrent Manager
CVEs associated with CVE-2026-101767
Weaknesses (CWE) in CVE-2026-101767
Timeline of CVE-2026-101767
- Horizon3.ai notified its Rapid Response customers of the vulnerability.
- Horizon3.ai disclosed the unauthenticated SQL injection / RCE in Oracle EBS to Oracle.
- 88 days elapsed between Horizon3.ai's report to Oracle (2026-07-24) and the fix in the October 2026 CPU, during which Rapid Response customers were notified and the issue was not publicly documented.
- CVE-2026-101767 was not found in the CISA Known Exploited Vulnerabilities catalog at the time of research (first 100,000 characters of the feed checked).
- NVD API returned no record for CVE-2026-101767 at the time of research; no in-the-wild exploitation or public PoC reported in the source.
- Horizon3.ai published pre-patch mitigations: remove /OA_HTML/AppsTCFServer from the EBS URL firewall allowlist, restrict EBS web-tier access to trusted networks, and monitor the application host and database.
- Horizon3.ai published technical details, affected versions (12.2.3-12.2.15), detection indicators and mitigations.
- Oracle released the October 2026 Critical Patch Update fixing CVE-2026-101767 (My Oracle Support Note KA923).
Sources cited for CVE-2026-101767
- Horizon3.ai: CVE-2026-101767 Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
- Oracle Critical Patch Update Advisory - October 2026
- NIST NVD: CVE-2026-101767
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
- CWE-306: Missing Authentication for Critical Function
- JVNDB-2017-008750: Oracle EBS Common Applications Gantt Server vulnerability (prior related issue)
Detection coverage for TL-2026-3988
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3988 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.