CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution

Reported by Horizon3.ai (Horizon3)

Summary by Cyber Security News20 Oct 2026, 23:23 CET

About this summary. This is a short excerpt from the description that Horizon3.ai published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-101767/

CVE-2026-101767 is an unauthenticated SQL injection vulnerability in Oracle E-Business Suite (EBS) that can be chained to achieve remote code execution. Discovered by Horizon3.ai’s attack research team, the vulnerability allows an attacker with network access to the affected Thin Client Framework (TCF) servlet to execute SQL as the APPS database user, then run operating system commands as the EBS… Source

Read the full article at Horizon3.ai →

Source attribution: headline and facts are from Horizon3.ai (horizon3.ai). Summary method: excerpt of the source description. See our source attribution policy.