Attackers have begun testing a critical, newly patched flaw in Oracle E-Business Suite that could expose payroll, HR and financial records without a login.
Attackers have started probing a serious flaw in Oracle E-Business Suite, a week after Oracle released a fix. Security firm Defused Cyber said its decoy systems recorded exploratory attacks on the morning of October 27. If your company runs this software and has not updated, now is the time.
The flaw is tracked as CVE-2026-101767 and scores 9.8 out of 10 for severity. Oracle patched it last week in its Critical Patch Update. Researchers at Horizon3.ai found it and reported it to Oracle on July 24, 2026.
Horizon3.ai describes it as an unauthenticated SQL injection. In plain terms, an attacker can send a specially crafted request that tricks the system's database into running commands, and no login is needed. That can then be chained into remote code execution, which means running commands on the server itself.
Oracle E-Business Suite is business software that companies use to run core operations. Horizon3.ai warns that, depending on the setup, exposed data may include financial, payroll, HR and procurement records. An attacker could read or change that data and run commands on the machine hosting the software.
This product has been a repeat target. Over the past year, two other critical flaws in it, CVE-2025-61882 and CVE-2026-46817, were exploited by attackers. The first was used by the Cl0p ransomware and extortion crew.
Companies that run Oracle E-Business Suite are the ones at risk. Systems reachable from the internet face the most danger. Internal systems can also be hit if an attacker gets onto the company network or a connected network segment and can reach the vulnerable part of the software.
If your business does not use this product, this alert does not apply to you. Employees and customers do not need to do anything themselves. The work falls to whoever manages the company's systems.
The alert box above lists the steps. The short version: get the patch installed, and if that must wait, use the workarounds in Oracle's advisory. Horizon3.ai has also published signs of compromise that IT teams can check against.
What Defused Cyber saw were exploratory attempts against decoy systems, which are fake targets set up to attract attackers. The material does not say whether any real company has been breached through this flaw. Probing like this often comes before wider attacks, so delay carries risk.
If your company runs Oracle E-Business Suite, have IT install Oracle's latest patch now, because attackers are already testing this flaw.
Morristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cashA viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youA message saying your Amazon account was hacked is often the scam itself. Checking in the Amazon app first can protect your card, gift balance and phone.
Read more: If Amazon says your account was hacked, check before you call
