CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Oracle E-Business Suite Application Object Library (Thin Client Framework servlet): unauthenticated SQL injection chained to OS command execution, fixed in the October 2026 CPU; Horizon3 published the chain

cve · CVE-2026-101767 single-source

Coverage
1
first 2026-10-21 → last 2026-10-25
Latest activity
2026-10-21
Oracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported…
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Defender insights

What each entry about CVE-2026-101767 tells a defender to do, newest first.

2026-10-21NOTABLEOracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported exploited

Exposure · detection

Story timeline

  1. 2026-10-21Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP
    trending-vulnerabilitiesOracle's October CPU carries six unauthenticated CVSS 10.0 rows and two WebLogic 9.8 flaws; none is reported exploited

Hunting pivots

Affected products
Oracle Access ManagerOracle E-Business SuiteOracle Identity ManagerOracle JD Edwards EnterpriseOneOracle SOA SuiteOracle WebLogic Server
Tags
patch-availablepre-authvulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter: Unix Shell

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows · ATT&CK page ↗

Entries about Oracle E-Business Suite Application Object Library (Thin Client Framework servlet): unauthenticated SQL injection chained to OS command execution, fixed in the October 2026 CPU; Horizon3 published the chain (1)

2026-10-21 · view entry permalink →

NOTABLECVE-2026-87337 +11updatedNATOA2

Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP

Oracle's Critical Patch Update advisory of 2026-10-20 contains 1295 new security patches (Oracle, 2026-10-20). Its risk matrices score 112 rows at CVSS 3.1 9.0 or higher, and 90 of those, covering 73 distinct CVE ids, are marked as remotely exploitable without authentication with a network attack vector (Oracle, 2026-10-20). Six rows score 10.0: CVE-2026-87337 in the Access Manager Authentication Engine (HTTP), CVE-2026-91231 in the SOA Suite Adapters (HTTP), CVE-2026-91216 and CVE-2026-91221 in the SOA Suite Fabric Layer (T3 and IIOP), CVE-2026-101809 in the E-Business Suite Workflow Notification Mailer (HTTP, 12.2.3 to 12.2.15) and CVE-2026-91299 in the JD Edwards EnterpriseOne Orchestrator security component (HTTP, 9.2.0.0 to 9.2.26.5) (Oracle, 2026-10-20). WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 carry CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3 and IIOP) at 9.8 and CVE-2026-87302 (HTTP) at 9.1; Identity Manager's End User Self Service has CVE-2026-91408 (T3 and IIOP, 9.8) and Access Manager's SAML path CVE-2026-87251 (9.8) (Oracle, 2026-10-20). The advisory states no exploitation for any row and carries only Oracle's standing sentence that it receives reports of attempts to exploit already-patched flaws (Oracle, 2026-10-20). Oracle points to My Oracle Support documents for patch availability (Oracle, 2026-10-20).

This Critical Patch Update contains 1295 new security patches across the product families listed below.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches.

Oracle
Improvementrun 2026-10-25T1308Z-auditcvestechniquessourcessourcing_notebody

Horizon3, which reported CVE-2026-101767 to Oracle on 2026-07-24, described the chain on release day, without publishing exploit code. An unauthenticated SQL injection in the Thin Client Framework servlet of E-Business Suite 12.2.3 to 12.2.15 (Application Object Library, Core component, CVSS 3.1 9.8), which the default EBS URL firewall configuration permits, gives SQL execution as the APPS database user and then operating-system commands as the EBS application account (Horizon3.ai, 2026-10-20). Until the update is in, Horizon3 advises removing the servlet from the URL firewall allowlist and restricting the web tier to trusted networks, measures that reduce exposure but do not replace patching (Horizon3.ai, 2026-10-20). Oracle scores the row 9.8, unauthenticated over HTTP (Oracle, 2026-10-20).

vulnerability21 Oct 03:41Zsingle-sourceOpen finding →
Sources: Oracle (Critical Patch Update Advisory, October 2026) · Horizon3.ai (CVE-2026-101767 write-up)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • horizon3.ai1 (50%)
  • oracle.com1 (50%)

External references

NVD · cve.org · CISA KEV

All cited sources (2)