Attacks target new Oracle E-Business Suite vulnerability
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Researchers have begun seeing attempts to exploit a critical, unauthenticated SQL injection flaw (CVE-2026-101767, CVSS 9.8) in Oracle E-Business Suite's Application Object Library, affecting versions 12.2.3 through 12.2.15. The flaw can allow full system takeover over HTTP, and a patch has been available for about a week.