Attackers are scanning the internet for Oracle business systems missing a critical October fix, so companies that run the software should confirm they have installed it.
Hackers have started looking for companies that have not yet installed Oracle's latest security fix. A security firm saw the first probing on October 27, one week after Oracle released the update on October 20. The target is Oracle E-Business Suite, business software that many large organizations use to run their operations.
The flaw is tracked as CVE-2026-101767. It sits in a core part of E-Business Suite and lets an outsider take over a vulnerable system over the web. The attacker does not need a password or an account. Oracle describes the attacks as low-complexity, meaning they are not hard to carry out.
Threat intelligence company Defused said its decoy systems recorded exploratory attacks on the morning of October 27. Decoys are fake systems set up to attract attackers. Defused described the flaw as a way to trick the software's database into running commands, which can then lead to full control of the machine.
Oracle has not yet labeled this flaw as used in real attacks. But the pattern is familiar. The Clop extortion gang has used another E-Business Suite flaw since early August 2025 to hit victims including Logitech, GlobalLogic, the Washington Post and several US universities. In June, the ShinyHunters gang used a flaw in Oracle's PeopleSoft software to steal data from organizations including Nottingham University, Nissan and the National Association of Insurance Commissioners.
Since November 2021, the US cybersecurity agency CISA has listed 46 Oracle bugs as actively exploited. Thirteen of them have also been used in ransomware attacks. Oracle itself says some attackers succeeded because customers had not applied available patches.
Companies that do not run Oracle E-Business Suite are not affected by this flaw. Organizations that have already installed the October 2026 update are in a much better position. The risk falls on anyone who runs the software and has not applied it yet.
The steps in the alert box above cover the fixes. The main one is to get the October update installed on every E-Business Suite system, and to ask IT staff or the software vendor to confirm it in writing.
Shadowserver, a group that tracks exposed systems, counts more than 670 E-Business Suite systems reachable from the internet, most of them in the United States. It does not say how many are decoys or have already been patched. It is also unclear whether any real organization has been breached through this flaw so far.
If your company runs Oracle E-Business Suite, confirm the October 2026 update is installed everywhere, because attackers are already looking for systems without it.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
