# CVE-2026-101767: Oracle E-Business Suite TCF Unauthenticated SQL Injection and Remote Code Execution

> Horizon3.ai reports an unauthenticated SQL injection in the Thin Client Framework (TCF) servlet of the Oracle Application Object Library (Core) component of Oracle E-Business Suite 12.2.3 through 12.2.15, chainable to operating-system command execution. Oracle fixed it in the October 2026 Critical Patch Update; no in-the-wild exploitation or public PoC is reported in the source.

- **Published:** 2026-10-20T21:36:36Z
- **Last reviewed:** 2026-10-20T21:36:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3988
- **ID:** TL-2026-3988
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-101767

## Description

CVE-2026-101767 affects the Oracle Application Object Library (Core) component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15 inclusive. The vulnerable code is reachable through the Thin Client Framework (TCF) servlet at /OA_HTML/AppsTCFServer (implementation class oracle.apps.fnd.tcf.SocketServer), which is permitted through the default EBS URL firewall configuration. An unauthenticated attacker with HTTP/HTTPS network access can send requests that result in SQL injection executing as the APPS database user (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8; CWE-89 and CWE-306).

Per Horizon3.ai, the SQL injection can be chained to remote code execution, giving command execution at the operating-system level with the privileges of the EBS application account. Data reachable through the APPS user includes financial, payroll, HR and procurement records. Horizon3.ai's indicators of compromise describe unauthenticated POST requests to /OA_HTML/AppsTCFServer that instantiate the Gantt data-server class oracle.apps.jtf.gantt.server.GanttDataServer, followed by SQL reconnaissance (database version, current user, directory objects), unexpected files in the $APPLPTMP directory, and the Oracle account spawning /bin/sh via the Concurrent Manager.

Horizon3.ai disclosed the issue to Oracle on 2026-07-24 and notified its Rapid Response customers. Oracle shipped the fix in the October 2026 Critical Patch Update on 2026-10-20 (My Oracle Support Note KA923). The source provides no threat-actor attribution, no confirmed in-the-wild exploitation and no public PoC. Earlier Gantt Server and TCF Server SQL injection issues in EBS (for example JVNDB-2017-008750, CVE-2019-2633/CVE-2019-2638) show this attack surface has been targeted before, but are separate vulnerabilities. At the time of research the NVD API returned no record for this CVE ID. Defenders who cannot patch immediately should remove /OA_HTML/AppsTCFServer from the URL firewall allowlist and restrict EBS web-tier access to trusted networks.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1213 Data from Information Repositories

## Sources

- [Horizon3.ai: CVE-2026-101767 Oracle E-Business Suite TCF SQL Injection and Remote Code Execution](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/)
- [Oracle Critical Patch Update Advisory - October 2026](https://www.oracle.com/security-alerts/cpuoct2026.html)
- [NIST NVD: CVE-2026-101767](https://nvd.nist.gov/vuln/detail/CVE-2026-101767)
- [CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)](https://cwe.mitre.org/data/definitions/89.html)
- [CWE-306: Missing Authentication for Critical Function](https://cwe.mitre.org/data/definitions/306.html)
- [JVNDB-2017-008750: Oracle EBS Common Applications Gantt Server vulnerability (prior related issue)](https://www.secualive.jp/en/feed/jvn/vulnerability/detailinfo/JVNDB-2017-008750/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3988