CVE-2026-101767 | Oracle E-Business Suite TCF SQL Injection and Remote Code Execution
CVE-2026-101767 is a critical (CVSS 9.8) unauthenticated SQL injection vulnerability in Oracle E-Business Suite 12.2.3–12.2.15. Horizon3 researchers identified an attack chain enabling remote code execution through the TCF servlet. Learn about affected versions, October 2026 patches, mitigations, and NodeZero Rapid Response validation.
Read at Horizon3.ai Attack Team
- Vendor
- Oracle
- Product
- E-Business Suite
- CVSS
- 9.8
- EPSS
- 0.006 (p49)
Why it ranks 38 (Notable)
- CVSS 9.8 critical
- Widely deployed vendor product (Oracle)
- Covered by 3 independent sources
- Threat research
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Horizon3.ai Attack Team (horizon3.ai)
- CVE-2026-101767 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.